CVE-2014-1671

Dell KACE K1000 <5.4.76847 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-1671. PoCs published by Rohan Stelling.

AI-analyzed exploit summary This exploit demonstrates SQL injection vulnerabilities in Dell Kace 1000 Systems Management Appliance via the `macAddress` parameter in SOAP requests to `/service/kbot_service.php`. The PoC includes payloads for both error-based and blind SQL injection, confirming the vulnerability.

Description

Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a (1) getUploadPath or (2) getKBot SOAP request to service/kbot_service.php; the ID parameter to (3) userui/advisory_detail.php or (4) userui/ticket.php; and the (5) ORDER[] parameter to userui/ticket_list.php.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Rohan Stelling · textwebappsphp
https://www.exploit-db.com/exploits/39057

This exploit demonstrates SQL injection vulnerabilities in Dell Kace 1000 Systems Management Appliance via the `macAddress` parameter in SOAP requests to `/service/kbot_service.php`. The PoC includes payloads for both error-based and blind SQL injection, confirming the vulnerability.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Dell Kace 1000 Systems Management Appliance 5.4.76847
No auth needed
Prerequisites: Network access to the target system · SOAP request capability
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/56396
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/90592
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/65029

Scores

EPSS 0.0195
EPSS Percentile 77.8%

Details

CWE
CWE-89
Status published
Products (5)
dell/kace_k1000_systems_management_appliance
dell/kace_k1000_systems_management_appliance_software 5.4.76847
dell/kace_k1000_systems_management_virtual_appliance
dell/kace_k1100s_systems_management_appliance
dell/kace_k1200s_systems_management_appliance
Published Jan 26, 2014
Tracked Since Feb 18, 2026