Sunbird Power IQ 9.2.0 API: Error-based SQL injection through an outdated API endpoint with missing input validation

Impact

Error-based SQL injection through an outdated API endpoint with missing input validation. Low score, but Power IQ is the power-monitoring layer that holds PDU credentials and outlet-level topology for the estate, so any read primitive into its database is worth closing.

Who can reach it

Access to the Power IQ API.

What to do

Apply the Sunbird fix. Additionally, disable legacy API endpoints you do not use - the root cause here is an old endpoint left enabled.

References