CVE-2018-5404
The Quest Kace K1000 Appliance is vulnerable to multiple Blind SQL Injections.
Vexday Risk Score
23Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 3.8%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
03 Jun 2019Public PoC
03 Jun 2019Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges ('User Console Only' role) to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. An authenticated remote attacker could leverage Blind SQL injections to obtain sensitive data.
Affected products
Quest Kace · K1000 Appliancepublic PoCs found — 1
exploitdbwww.exploit-db.com/exploits/46956unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →