SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to (1) create administrator accounts via a crafted request to /createnewaccount or (2) write to arbitrary files via the fileName parameter to /userentry.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Sysaid | Sysaid | * | 15.1 (including) |