CVE-2024-32738

published 2024-05-14

CVE-2024-32738: A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via…

Priority P1 79 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

ITW EXPLOIT VulnCheck KEV

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "query_ptask_lean" function within MCUDBHelper.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
cyberpower	cyberpower_powerpanel_enterprise	< 2.8.3	2.8.3
cyberpower	powerpanel	< 2.8.3	2.8.3

Detection & IOCs extracted from sources · hover to see the quote

url /api/v1/ndconfig?mode=lean&uid=1'%20UNION%20select%201,2,3,sqlite_version();--↗

port 8085↗

command curl "<target>:8085/api/v1/ndconfig?mode=lean&uid=1'%20UNION%20select%201,2,3,sqlite_version();--"↗

path /api/v1/ndconfig↗

sigma↗

matchers: body contains ':"finished"' AND '"success":' AND 'modifiedtime":' with content-type application/json and HTTP 200

• → The SQLi payload is injected via the 'uid' query parameter on the /api/v1/ndconfig endpoint with mode=lean. A UNION-based injection using sqlite_version() is the PoC technique. Detect requests containing UNION select patterns targeting this endpoint. ↗
• → The vulnerable function is query_ptask_lean in mcu.jar (com.cyberpower.mcu.core.persist.MCUDBHelper). It directly interpolates the contract_uuid parameter into a SQL query against the pcontractresult table without sanitization. ↗
• → Successful exploitation returns a JSON response with status 'finished' and a 'modifiedtime' field containing the injected value (e.g., SQLite version string). Use the regex '"modifiedtime":"([0-9.]+)"' to confirm data exfiltration. ↗
• → Shodan query 'html:"PDNU"' can be used to identify internet-exposed CyberPower PowerPanel Enterprise (PDNU) instances potentially vulnerable to this CVE. ↗
• → The vulnerability is unauthenticated (PR:N, UI:N). No session or credentials are required to exploit the /api/v1/ndconfig endpoint on port 8085. ↗

• · The vulnerability affects CyberPower PowerPanel Enterprise versions prior to v2.8.3 only. Version 2.8.3 and later are patched. ↗
• · The backend database is SQLite (version 3.21.0 observed in PoC output), which limits certain SQLi techniques but allows UNION-based data extraction. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vulncheck 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89