CVE-2015-2995

CVE-2015-2995 describes an arbitrary file upload vulnerability in the RdsLogsEntry servlet of SysAid Help Desk versions prior to 15.2. Attackers can exploit this by appending a NULL byte to a malicious file's extension (e.g., .war%00), bypassing file extension checks to upload and execute arbitrary code. This vulnerability has a CVSS score of 6.8, indicating a medium severity with network-based attacks, medium complexity, and potential for partial compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, a Metasploit module exists, and its EPSS score suggests a high likelihood of exploitation. Despite available exploit code, there is minimal community discussion or media coverage surrounding this CVE.