{"vulnerability": "CVE-2015-6922", "sightings": [{"uuid": "3466079a-e0e7-473c-b7e1-6b4fd7b420fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-6922", "type": "exploited", "source": "https://www.exploit-db.com/exploits/38351", "content": "", "creation_timestamp": "2015-09-29T00:00:00.000000Z"}, {"uuid": "6c98f143-c561-4b7c-b015-9b343758eb54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-6922", "type": "exploited", "source": "https://www.exploit-db.com/exploits/38401", "content": "", "creation_timestamp": "2015-10-05T00:00:00.000000Z"}, {"uuid": "7aa1ecb8-432f-4a90-ad10-67f6fe10db93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-6922", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:42.000000Z"}, {"uuid": "ec63542a-d6e1-4315-9f95-536bd2a65a9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-6922", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:41.000000Z"}, {"uuid": "2c2f4acd-f455-41c1-b915-17a98787bff3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-6922", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/kaseya_master_admin.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "36d02eb8-c312-47c6-856b-94ced851aa91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-6922", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/kaseya_uploader.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "e732e6bc-b04b-4e8c-83a6-2a8e11db7231", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-6922", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/kaseya_master_admin.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Pedro Ribeiro \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module abuses the setAccount page on Kaseya VSA between 7 and 9.1 to create a new\\n          Master Administrator account. Normally this page is only accessible via the localhost\\n          interface, but the application does nothing to prevent this apart from attempting to\\n          force a redirect. This module has been tested with Kaseya VSA v7.0.0.17, v8.0.0.10 and\\n          v9.0.0.3.\", \"disclosure_date\": \"2015-09-23\", \"fullname\": \"auxiliary/admin/http/kaseya_master_admin\", \"is_install_path\": true, \"mod_time\": \"2025-05-16 01:16:37 +0000\", \"name\": \"Kaseya VSA Master Administrator Account Creation\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/http/kaseya_master_admin.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"admin/http/kaseya_master_admin\", \"references\": [\"CVE-2015-6922\", \"ZDI-15-448\", \"URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/Kaseya/kaseya-vsa-vuln-2.txt\", \"URL-https://seclists.org/bugtraq/2015/Sep/132\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:46.901382Z"}, {"uuid": "cd7c09a0-361d-44a6-bdb5-53c51eb1fa68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-6922", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/kaseya_uploader.rb", "content": "{\"aliases\": [], \"arch\": \"x86\", \"author\": [\"Pedro Ribeiro \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an arbitrary file upload vulnerability found in Kaseya VSA versions\\n          between 7 and 9.1. A malicious unauthenticated user can upload an ASP file to an arbitrary\\n          directory leading to arbitrary code execution with IUSR privileges. This module has been\\n          tested with Kaseya v7.0.0.17, v8.0.0.10 and v9.0.0.3.\", \"disclosure_date\": \"2015-09-23\", \"fullname\": \"exploit/windows/http/kaseya_uploader\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:31 +0000\", \"name\": \"Kaseya VSA uploader.aspx Arbitrary File Upload\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/http/kaseya_uploader.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/kaseya_uploader\", \"references\": [\"CVE-2015-6922\", \"ZDI-15-449\", \"URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/Kaseya/kaseya-vsa-vuln-2.txt\", \"URL-https://seclists.org/bugtraq/2015/Sep/132\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Kaseya VSA v7 to v9.1\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:52.668688Z"}]}