CVE-2021-30486: 
SysAid Server vulnerability analysis and mitigation

SysAid Help Desk System version 20.3.64 b14 was found to be affected by SQL injection vulnerabilities. The vulnerability, identified as CVE-2021-30486, was discovered on March 30, 2021, and publicly disclosed on July 22, 2021. The vulnerability affects multiple components of the SysAid Help Desk Enterprise Edition software (EH337 Blog).

The SQL injection vulnerability affects multiple JSP files including AssetManagementChart.jsp, AssetManagementList.jsp, and AssetManagementSummary.jsp. The vulnerability can be exploited through various parameters including 'computerID' (GET/POST) and 'group1' parameters. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility with low attack complexity (NVD).

Successful exploitation of this vulnerability could lead to unauthorized access to the database, potentially allowing attackers to view, modify, or delete sensitive information. The high CVSS score indicates severe potential impacts on confidentiality, integrity, and availability of the system (NVD).

The vulnerability requires user-level access to the system for exploitation. It can be exploited using two injection techniques: stacked queries and time-based blind SQL injection. The vulnerability is exploitable through the Asset Management functionality when selecting data from Control ListBox (EH337 Blog).

Organizations using affected versions of SysAid Help Desk System should upgrade to a version newer than 20.3.64 b14. The vulnerability has been classified under CWE-89 (SQL Injection), indicating that proper input validation and parameterized queries should be implemented as part of the security controls (NVD).