CVE-2018-11139

HIGH

Quest KACE System Management Appliance 8.0.318 - Authenticated OS Command Injection via TEST_SERVER Parameter

Title source: llm
STIX 2.1

Description

The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method.

References (1)

Core 1
Core References
Exploit, Technical Description, Third Party Advisory x_refsource_misc
https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities

Scores

CVSS v3 8.8
EPSS 0.4292
EPSS Percentile 98.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (1)
quest/kace_system_management_appliance 8.0.318
Published May 31, 2018
Tracked Since Feb 18, 2026