SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, a…

published 2015-06-08 11y ago modified 2026-06-17 4mo ago also EUVD-2015-3080

cvss: 5.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 26.2%; EPSS 26.2% chance of exploitation in 30 days, percentile 98%
public exploits: 2; Metasploit and Exploit-DB

SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, as demonstrated by decrypting the database password in WEB-INF/conf/serverConf.xml.

Is CVE-2015-2998 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

2015-06-03 First public exploit (Metasploit auxiliary/admin/http/sysaid_sql_creds)
2015-06-08 Published

Exploit prediction

26.18% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit auxiliary/admin/http/sysaid_sql_creds SysAid Help Desk Database Credentials Disclosure metasploit auxiliary, normal rank, 2015-06-03
EDB-43885 SysAid Help Desk 14.4 - Multiple Vulnerabilities webapps, 2015-06-10
seclists.org http://seclists.org/fulldisclosure/2015/Jun/8 referenced PoC, tagged "exploit" by a source, unverified
packetstormsecurity.com http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

seclists.org /fulldisclosure/2015/Jun/8
mailing-list, exploit
packetstormsecurity.com /files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html
exploit
sysaid.com /blog/entry/sysaid-15-2-your-voice-your-service-desk
vendor-advisory
securityfocus.com /archive/1/535679/100/0/threaded
mailing-list
securityfocus.com /bid/75035
vdb-entry

Sources

CVE List CVE-2015-2998
NVD CVE-2015-2998

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.