CVE-2024-32737

HIGHNuclei

CyberPower PowerPanel Enterprise SQL Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-32737 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "query_contract_result" function within MCUDBHelper.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 22, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 9, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

CyberPower PowerPanel Enterprise

Browse CyberPower / CyberPower PowerPanel Enterprise

Default status: unaffected

CVE ListBefore 2.8.3affected

PowerPanel Enterprise

Browse CyberPower / PowerPanel Enterprise

Default status: unknown

VulnCheck, CVE ListBefore 2.8.3affected

Nuclei templates

1
ProjectDiscoveryHIGHCyberPower - SQL InjectionCVSS 7.5

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3.

Impact

An unauthenticated remote attacker can leak sensitive information via the "query_contract_result" function within MCUDBHelper.

Remediation

Apply the latest security patches and updates from the vendor to address this vulnerability.

WeaknessesCWE-89
AuthorsDhiyaneshDk
Template tagscvecve2024cyberpowersqlivkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Shodan: html:"<title>PDNU</title>"
https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote https://www.tenable.com/security/research/tra-2024-14 https://nvd.nist.gov/vuln/detail/CVE-2024-32737

Source: ProjectDiscovery

References

3