CVE-2024-32736: CyberPower PowerPanel SQLI Vulnerability

CVE-2024-32736 Overview

CVE-2024-32736 is a SQL injection vulnerability in CyberPower PowerPanel Enterprise versions prior to v2.8.3. The flaw resides in the query_utask_verbose function within MCUDBHelper, where unsanitized input is passed into a database query. An unauthenticated remote attacker can exploit the network-accessible interface to extract sensitive information from the backing database. The weakness is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. PowerPanel Enterprise manages UPS and power infrastructure across data centers, making leaked operational data valuable for follow-on attacks.

Critical Impact
Unauthenticated remote attackers can exfiltrate sensitive database contents from PowerPanel Enterprise deployments over the network without user interaction.

Affected Products

CyberPower PowerPanel Enterprise versions prior to v2.8.3
Windows deployments of PowerPanel Enterprise (per published CPE)
Environments using MCUDBHelper with the query_utask_verbose function

Discovery Timeline

2024-05-14 - CVE-2024-32736 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32736

Vulnerability Analysis

The vulnerability is a classic SQL injection reachable without authentication. The query_utask_verbose function inside the MCUDBHelper component builds SQL statements using attacker-controlled input without proper parameterization or escaping. Because the attack vector is the network and no privileges or user interaction are required, exposed PowerPanel Enterprise instances are directly reachable by remote adversaries. Successful exploitation leaks confidential data held by the application, including operational telemetry, configuration records, and potentially credentials stored by the management platform. Integrity and availability are not directly affected, but disclosed data commonly enables lateral movement and privileged access to managed UPS and power infrastructure.

Root Cause

The root cause is improper neutralization of SQL syntax in user-supplied parameters processed by the query_utask_verbose function. Input is concatenated into a query string rather than bound through prepared statements, allowing attackers to alter the query's logic. The absence of authentication on the affected code path amplifies the exposure.

Attack Vector

An attacker sends a crafted HTTP request to the PowerPanel Enterprise management service reachable over the network. Malicious SQL fragments embedded in a parameter processed by query_utask_verbose alter the intended query. The database returns attacker-controlled data through the application response, enabling extraction using boolean, union, or error-based techniques. Refer to the Tenable Security Research Advisory for protocol-level detail.

Detection Methods for CVE-2024-32736

Indicators of Compromise

Unusual HTTP requests to PowerPanel Enterprise endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(
Repeated requests with incrementally varying payloads consistent with automated SQL injection tooling
Database process spikes or long-running queries originating from the PowerPanel service account
Outbound data transfers from the PowerPanel host disproportionate to normal management traffic

Detection Strategies

Deploy web application firewall rules that inspect PowerPanel Enterprise request parameters for SQL injection signatures.
Enable verbose application and database logging to capture the full query text reaching MCUDBHelper.
Correlate failed and anomalous queries with source IPs to identify probing activity against unauthenticated endpoints.

Monitoring Recommendations

Alert on any request to PowerPanel Enterprise from IPs outside the management network segment.
Monitor the underlying database for query patterns referencing schema metadata such as information_schema from the PowerPanel service account.
Track version and patch state of PowerPanel Enterprise assets to identify instances still below v2.8.3.

How to Mitigate CVE-2024-32736

Immediate Actions Required

Upgrade CyberPower PowerPanel Enterprise to v2.8.3 or later using the vendor package.
Restrict network access to PowerPanel Enterprise management interfaces to trusted administrative subnets only.
Review database and application logs for evidence of prior exploitation attempts against query_utask_verbose.
Rotate any credentials or secrets stored by or accessible to the PowerPanel Enterprise database.

Patch Information

CyberPower fixed the SQL injection in PowerPanel Enterprise v2.8.3. Consult the CyberPower Release Note for the official upgrade package and version details. Additional technical context is available in the Tenable Security Research Advisory.

Workarounds

Place PowerPanel Enterprise behind a reverse proxy or WAF that blocks SQL injection patterns in request parameters.
Segment the PowerPanel Enterprise host into an isolated management VLAN with strict ACLs limiting inbound access.
Disable external exposure of the PowerPanel Enterprise service until the patch is applied.

bash

# Configuration example: restrict PowerPanel Enterprise access with host firewall (Windows)
netsh advfirewall firewall add rule name="PowerPanel-Restrict" ^
  dir=in action=block protocol=TCP localport=3052
netsh advfirewall firewall add rule name="PowerPanel-Allow-Admins" ^
  dir=in action=allow protocol=TCP localport=3052 remoteip=10.10.0.0/24