CVE-2015-3001 | Vulnerability Database | Aqua Security

SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.

Affected Software

Name	Vendor	Start Version	End Version
Sysaid	Sysaid	*	15.1 (including)

References

http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html
http://seclists.org/fulldisclosure/2015/Jun/8
http://www.securityfocus.com/archive/1/535679/100/0/threaded
http://www.securityfocus.com/bid/75035
https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk
http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html
http://seclists.org/fulldisclosure/2015/Jun/8
http://www.securityfocus.com/archive/1/535679/100/0/threaded
http://www.securityfocus.com/bid/75035
https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk

NVD	https://nvd.nist.gov/vuln/detail/CVE-2015-3001
CWE	https://cwe.mitre.org/data/definitions/255.html