CVE-2019-13078
📋 TL;DR
This SQL injection vulnerability in Quest KACE Systems Management Appliance allows authenticated users to execute arbitrary SQL commands against the database through the sort_column parameter in /common/user_profile.php. It affects organizations using the vulnerable version of the KACE appliance for systems management. Attackers could potentially read, modify, or delete sensitive data in the database.
💻 Affected Systems
- Quest KACE Systems Management Appliance Server Center
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise leading to data exfiltration, privilege escalation, and complete system takeover through subsequent attacks.
Likely Case
Unauthorized data access, potential credential theft, and lateral movement within the network.
If Mitigated
Limited impact if proper input validation and database permissions are enforced.
🎯 Exploit Status
SQL injection is well-understood, and authenticated access lowers the barrier for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version 9.1.318 or later as per vendor advisory.
Vendor Advisory: https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report
Restart Required: Yes
Instructions:
1. Backup the appliance configuration and database. 2. Download the latest patch from Quest support portal. 3. Apply the patch via the KACE admin interface. 4. Restart the appliance as required.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall (WAF) rules to block SQL injection patterns in the sort_column parameter.
Access Restriction
allRestrict access to /common/user_profile.php to only necessary users or IP addresses.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the KACE appliance from critical systems.
- Enforce least privilege for database accounts used by the application to limit potential damage.
🔍 How to Verify
Check if Vulnerable:
Check the appliance version via the admin interface or by reviewing the system information page. If version is 9.1.317, it is vulnerable.Check Version:
Log into the KACE admin interface and navigate to Help > About to view the version.Verify Fix Applied:
After patching, verify the version is 9.1.318 or later and test the /common/user_profile.php endpoint with SQL injection payloads to confirm mitigation.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by access to /common/user_profile.php
- Unexpected database errors in application logs
Network Indicators:
- HTTP POST requests to /common/user_profile.php with SQL keywords in parameters
- Unusual outbound database connections from the appliance
SIEM Query:
source="kace_logs" AND (url="/common/user_profile.php" AND (param="sort_column" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "--"))