Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2022-29807: A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_agent_installer.php.
CVE-2022-29807 · published 4 years ago
Summary
A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_agent_installer.php.
What to do
- Update quest kace_systems_management_appliance to version 12.1.168 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| quest | kace_systems_management_appliance |
< 12.1.168 cpe:2.3:a:quest:kace_systems_management_appliance:*:*:*:*:*:*:*:* |
Original advisory text
A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_agent_installer.php.
A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_agent_installer.php.
References
- https://support.quest.com/kace-systems-management-appliance/kb/338162/quest-resp... Vendor Advisory
- https://support.quest.com/kb/338162 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published2 Aug 2022
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2022-29807 · NVD
Track software like this
Free during beta