What is the CVSS score of CVE-2014-1671?

CVE-2014-1671 has a CVSS 2.0 base score of 6.5 (Medium). CVSS vector: AV:N/AC:L/Au:S/C:P/I:P/A:P. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2014-1671?

Yes, a public proof-of-concept exploit is available for CVE-2014-1671. Prioritise patching immediately. EPSS: 0.3%.

PHP CVE-2014-1671

MEDIUM

SQL Injection (CWE-89)

2014-01-26 cve@mitre.org

PHP Dell SQLi Kace K1000 Systems Management Appliance Software Kace K1000 Systems Management Virtual Appliance Kace K1000 Systems Management Appliance Kace K1100S Systems Management Appliance Kace K1200S Systems Management Appliance

6.5

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/Au:S/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:S/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jan 26, 2014 - 01:55 cve.org

MEDIUM 6.5

DescriptionCVE.org

Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a (1) getUploadPath or (2) getKBot SOAP request to service/kbot_service.php; the ID parameter to (3) userui/advisory_detail.php or (4) userui/ticket.php; and the (5) ORDER[] parameter to userui/ticket_list.php.

AnalysisAI

Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a (1) getUploadPath or (2) getKBot SOAP request to service/kbot_service.php; the ID parameter to (3) userui/advisory_detail.php or (4) userui/ticket.php; and the (5) ORDER[] parameter to userui/ticket_list.php. Affected products include: Dell Kace K1000 Systems Management Appliance Software, Dell Kace K1000 Systems Management Virtual Appliance, Dell Kace K1000 Systems Management Appliance, Dell Kace K1100S Systems Management Appliance, Dell Kace K1200S Systems Management Appliance.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.