Overview
CVE-2025-2775 is a severe vulnerability affecting SysAid On-Prem versions up to and including 23.3.40. This vulnerability poses significant security risks as it enables an attacker to exploit an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality. This exploitation could lead to an administrator account takeover and file read primitives, which can compromise system security and data integrity. Given the potential for system compromise or data leakage, understanding and mitigating this vulnerability should be a priority for any organization using the affected SysAid On-Prem versions.
Vulnerability Summary
CVE ID: CVE-2025-2775
Severity: Critical (9.3 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise, data leakage, and administrator account takeover
Affected Products
No phone number, email, or personal info required.
Product | Affected Versions
SysAid On-Prem | <= 23.3.40 How the Exploit Works
The CVE-2025-2775 vulnerability is an unauthenticated XXE (XML External Entity) vulnerability in SysAid On-Prem’s Checkin processing functionality. This makes it possible for an attacker to send a specially crafted XML request that includes external entities. When the server parses this XML request, it can be tricked into disclosing sensitive data, compromising the system, or allowing for an administrator account takeover.
Conceptual Example Code
Here’s a conceptual example of how the vulnerability might be exploited. This is a sample HTTP request with a malicious XML payload:
POST /checkin HTTP/1.1
Host: target.example.com
Content-Type: application/xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<foo>&xxe;</foo>This example attempts to read the /etc/passwd file on a Unix-based system. If the server is vulnerable and parses this XML, the contents of the /etc/passwd file will be included in the server’s response, thereby leading to information disclosure.
Mitigation Measures
The primary mitigation for CVE-2025-2775 is to apply the vendor patch. SysAid has released updates that address this vulnerability, and affected organizations are advised to update their systems as soon as possible to the latest version.
In the absence of an immediate patch application, organizations can use a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) to detect and block malicious XML input. This can serve as a temporary mitigation measure to prevent the exploitation of this vulnerability until it is possible to apply the vendor patch.
