CVE-2021-30486

Name of the Vulnerable Software and Affected Versions SysAid version 20.3.64 b14

Description The issue is related to Blind and Stacker SQL injection. It can be exploited via several API endpoints, including "AssetManagementChart.jsp" with computerID or group1 parameters, "AssetManagementList.jsp" with computerID or group1 parameters, and "AssetManagementSummary.jsp" with the group1 parameter.

Recommendations For SysAid version 20.3.64 b14, consider disabling access to the vulnerable API endpoints, such as "AssetManagementChart.jsp", "AssetManagementList.jsp", and "AssetManagementSummary.jsp", until a patch is available. Restrict the use of the computerID and group1 parameters in these endpoints to minimize the risk of exploitation.