CVE-2018-11136

The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, a blind time-based type).

Score
CVSS 3.0 9.8 Critical
Status
Modified - cve@mitre.org
Published
2018-05-31
Last modified
2024-08-05
Weaknesses
CWE-89

Affected products

References

 
 
© AVABIS GmbH privacypolicy about