CVE-2024-32739

published 2024-05-14

CVE-2024-32739: A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via…

Priority P1 79 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

ITW EXPLOIT VulnCheck KEV

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "query_ptask_verbose" function within MCUDBHelper.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
cyberpower	cyberpower_powerpanel_enterprise	< 2.8.3	2.8.3
cyberpower	powerpanel	< 2.8.3	2.8.3

Detection & IOCs extracted from sources · hover to see the quote

url /api/v1/ndconfig?mode=&uid=1'%20UNION%20select%201,2,3,sqlite_version();--↗

port 8085↗

path /api/v1/ndconfig↗

command curl ">:8085/api/v1/ndconfig?mode=&uid=1'%20UNION%20select%201,2,3,sqlite_version();--"↗

• → Detect SQLi exploitation attempts against CVE-2024-32739 by monitoring GET requests to /api/v1/ndconfig with a uid parameter containing a UNION SELECT payload (e.g., uid=1' UNION select ...) on port 8085. ↗
• → A successful exploitation response contains JSON fields {"status":"finished","results":[{"code":"<sqlite_version>","action":"1","ip":"2","ts":"3"}]}; alert on responses from /api/v1/ndconfig matching this pattern. ↗
• → The vulnerable function is query_ptask_verbose in mcu.jar (com.cyberpower.mcu.core.persist.MCUDBHelper); the contract_uuid parameter is injected unsanitized into a SQL FORMAT string. Monitor Java process activity in mcu.jar for anomalous SQL queries involving UNION SELECT against the pcontract/ptask/ptaskresult tables. ↗
• → Nuclei template for CVE-2024-32739 matches HTTP 200 responses with Content-Type application/json containing both ':"finished"' and '"results":' in the body, and extracts the SQLite version via regex '"code":"([0-9.]+)"'.

• · The vulnerability is unauthenticated — no credentials are required to exploit the SQLi via the uid parameter on the /api/v1/ndconfig endpoint. ↗
• · The affected versions are CyberPower PowerPanel Enterprise prior to v2.8.3; the fix is to apply the latest vendor-supplied update. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vulncheck 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89