SysOwned, Your Friendly Support Ticket - SysAid On-Premise Pre-Auth RCE Chain (CVE-2025-2775 And Friends)

1: public void doPost(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) { 2: String requestURI = httpServletRequest.getRequestURI(); 3: String stringBuffer = httpServletRequest.getRequestURL().toString(); 4: if (IlientConf.getInstance().getConf().getLoadAccountsOnDemand()) { 5: stringBuffer = stringBuffer.replace("http:", "https:"); 6: } 7: String accountIDFromURL = Helper.getAccountIDFromURL(stringBuffer, Services.getInstance(getServletContext())); 8: if (stringBuffer.lastIndexOf("/mdm/") > 0) { 9: this.f1371a = stringBuffer.substring(0, stringBuffer.lastIndexOf("/") + 1); 10: } else { 11: this.f1371a = stringBuffer.substring(0, stringBuffer.lastIndexOf("/mobile")) + "/mdm/"; 12: } 13: 14: [..SNIP..] 15: 16: } else if (requestURI.endsWith("checkin")) { 17:…