SQL Injection Vulnerabilities in Dell KACE K1000

CVE-2014-1671

Summary

Multiple SQL injection vulnerabilities exist in Dell KACE K1000 versions 5.4.76847 and potentially earlier. These vulnerabilities can be exploited by remote attackers or authenticated users to execute arbitrary SQL commands through various parameters. Specifically, the macAddress element in SOAP requests to getUploadPath and getKBot, as well as the ID parameter to userui/advisory_detail.php and userui/ticket.php, are affected. Additionally, the ORDER[] parameter in userui/ticket_list.php is also vulnerable, potentially allowing sensitive data exposure or manipulation.

References