medium6.5Public exploit code
CVE-2014-1671
Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitr…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Dell Kace 1000 Systems Management Appliance DS-2014-001 - Multiple SQL Injections2014-01-13 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a (1) getUploadPath or (2) getKBot SOAP request to service/kbot_service.php; the ID parameter to (3) userui/advisory_detail.php or (4) userui/ticket.php; and the (5) ORDER[] parameter to userui/ticket_list.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dell | Kace K1000 Systems Management Appliance Software | Version 5.4.76847 |
| Dell | Kace K1000 Systems Management Virtual Appliance | All versions |
| Dell | Kace K1000 Systems Management Appliance | All versions |
| Dell | Kace K1100s Systems Management Appliance | All versions |
| Dell | Kace K1200s Systems Management Appliance | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/56396
- http://www.baesystemsdetica.com.au/Research/Advisories/Dell-KACE-K1000-SQL-Injection-%28DS-2014-001%29
- http://www.securityfocus.com/bid/65029
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90592
- http://secunia.com/advisories/56396
- http://www.baesystemsdetica.com.au/Research/Advisories/Dell-KACE-K1000-SQL-Injection-%28DS-2014-001%29
- http://www.securityfocus.com/bid/65029
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90592