Dell Kace 1000 Systems Management Appliance DS-2014-001 Multiple SQL Injection Vulnerabilities

Bugtraq ID:	65029
Class:	Input Validation Error
CVE:	CVE-2014-1671
Remote:	Yes
Local:	No
Published:	Jan 13 2014 12:00AM
Updated:	Jan 28 2014 01:03AM
Credit:	Rohan Stelling, Bart Borkowski, and Alex Manusu, Detica.
Vulnerable:
Not Vulnerable:

Dell Kace 1000 Systems Management Appliance DS-2014-001 Multiple SQL Injection Vulnerabilities

Dell Kace 1000 Systems Management Appliance is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Dell Kace 1000 Systems Management Appliance 5.4.76847 is vulnerable; other versions may also be affected.

Dell Kace 1000 Systems Management Appliance DS-2014-001 Multiple SQL Injection Vulnerabilities

An attacker can exploit these issues using a web browser.

The following example data is available:

• /data/vulnerabilities/exploits/65029.txt

Dell Kace 1000 Systems Management Appliance DS-2014-001 Multiple SQL Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Dell Kace 1000 Systems Management Appliance DS-2014-001 Multiple SQL Injection Vulnerabilities

References: