PT-2019-13020

CVE-2019-12918

·

Published

2019-11-06

·

Updated

2019-11-07

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance Server Center version 9.1.317
Description The issue concerns a SQL injection problem. The affected file is software library.php, and the vulnerable parameters are order[0][column] and order[0][dir].
Recommendations For Quest KACE Systems Management Appliance Server Center version 9.1.317, consider restricting access to the software library.php file and avoid using the parameters order[0][column] and order[0][dir] until a fix is available.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2019-12918
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com