CVE-2024-32737 Scanner

CyberPower PowerPanel Enterprise is a comprehensive power management platform used by IT administrators to monitor, control, and automate uninterruptible power supplies (UPS) across network environments. It provides real-time status updates, event logging, and remote management capabilities, making it essential for businesses that require high availability and power continuity. The software is deployed in data centers, hospitals, and manufacturing facilities to protect critical infrastructure from power disruptions.

The SQL Injection vulnerability, tracked as CVE-2024-32737, arises from insufficient input validation in the application's database query handling. When user-supplied data is directly concatenated into SQL statements without proper sanitization, an attacker can inject malicious SQL code. This flaw exists because the application fails to use parameterized queries or prepared statements, leaving the database layer exposed to manipulation.

Specifically, the vulnerability is located in the login functionality of the PowerPanel Enterprise web interface. The username parameter is passed unsanitized into a SQL query that authenticates users. By crafting a specially formatted username string, an attacker can alter the query's logic to bypass authentication or extract data from the underlying database, such as user credentials or configuration details.

Successful exploitation of this vulnerability can lead to unauthorized access to the PowerPanel Enterprise system, potentially allowing an attacker to view sensitive information, modify UPS settings, or disrupt power management operations. In a worst-case scenario, this could result in denial of service or physical damage to connected equipment, impacting business continuity and safety.