CVE-2018-5404 The Quest Kace K1000 Appliance is vulnerable to multiple Blind SQL Injections.
An authenticated attacker can exploit blind SQL injections to retrieve sensitive data or copy the entire database from the Kace K1000 Appliance.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-5404?
CVE-2018-5404 is a medium-severity SQL injection vulnerability in Quest Kace K1000 Appliance, published on 3 Jun 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges ('User Console Only' role) to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. An authenticated remote attacker could leverage Blind SQL injections to obtain sensitive data.
Weakness: CWE-89
Which versions are affected by CVE-2018-5404?
It affects 1 product.
Products include Quest Kace Systems Management Appliance Firmware.
How do I fix CVE-2018-5404?
No fix has been published for CVE-2018-5404 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2018-5404 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-5404 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Quest Kace K1000 Appliance
Sources
Also known as GHSA-rgpj-f9xq-fr9h.