{"vulnerability": "cve-2015-2995", "sightings": [{"uuid": "37a24c68-14ff-4a66-9b38-ab338de30efc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-2995", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:42.000000Z"}, {"uuid": "71922142-0af2-4691-b10f-484955cbdc8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-2995", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:38.000000Z"}, {"uuid": "da12ac97-2d70-46b4-83ff-5461885b87f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-2995", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/sysaid_rdslogs_file_upload.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "b145983b-c4a3-4b43-b516-1d3fb9164665", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2015-2995", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/37667", "content": "", "creation_timestamp": "2015-07-21T00:00:00.000000Z"}, {"uuid": "5a4632b8-dc20-474a-92f6-2f19510d192f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-2995", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/sysaid_rdslogs_file_upload.rb", "content": "{\"aliases\": [], \"arch\": \"java\", \"author\": [\"Pedro Ribeiro \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a file upload vulnerability in SysAid Help Desk v14.3 and v14.4.\\n          The vulnerability exists in the RdsLogsEntry servlet which accepts unauthenticated\\n          file uploads and handles zip file contents in an insecure way. By combining both weaknesses,\\n          a remote attacker can accomplish remote code execution. Note that this will only work if the\\n          target is running Java 6 or 7 up to 7u25, as Java 7u40 and above introduces a protection\\n          against null byte injection in file names. This module has been tested successfully on version\\n          v14.3.12 b22 and v14.4.32 b25 in Linux. In theory this module also works on Windows, but SysAid\\n          seems to bundle Java 7u40 and above with the Windows package which prevents the vulnerability\\n          from being exploited.\", \"disclosure_date\": \"2015-06-03\", \"fullname\": \"exploit/multi/http/sysaid_rdslogs_file_upload\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"SysAid Help Desk 'rdslogs' Arbitrary File Upload\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/http/sysaid_rdslogs_file_upload.rb\", \"platform\": \"Java\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/sysaid_rdslogs_file_upload\", \"references\": [\"CVE-2015-2995\", \"URL-https://seclists.org/fulldisclosure/2015/Jun/8\"], \"rport\": 8080, \"session_types\": false, \"targets\": [\"SysAid Help Desk v14.3 - 14.4 / Java Universal\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:16.000507Z"}]}