CVE-2018-11139 | BDVDB-2026-101387 Detail

Description#

The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities

Exploit#

No public exploit known

History#

Version 12018-05-31Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.