High severity · published Nov 6, 2019
CVE-2019-13079
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection
8.8
CVSS
1.2%
EPSS
No
On KEV
Description
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /adminui/history_log.php. The affected parameter is TYPE_NAME.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KS
Kace Systems Management Appliance · Quest
9.1.317 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-13079
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-13079
Vendor Advisory
https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report
Product
https://www.quest.com/products/kace-systems-management-appliance/
More from Kace Systems Management Appliance
10.0
CVE-2025-32975
Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
9.8
CVE-2021-32088
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273
9.8
CVE-2021-32084
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273
9.8
CVE-2021-32086
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273
9.8
CVE-2022-29807
A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_agent_installer.php