CVE-2025-55703
📋 TL;DR
An error-based SQL injection vulnerability in Sunbird Power IQ 9.2.0 API allows attackers to manipulate SQL queries through an outdated endpoint with insufficient input validation. This affects organizations using Power IQ 9.2.0 for data center infrastructure management. The vulnerability has been fixed in version 9.2.1.
💻 Affected Systems
- Sunbird Power IQ
📦 What is this software?
Power Iq by Sunbirddcim
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary SQL commands, potentially leading to data theft, data manipulation, or complete database compromise.
Likely Case
Limited data extraction or manipulation due to API endpoint constraints and authentication requirements.
If Mitigated
Minimal impact with proper network segmentation and API access controls in place.
🎯 Exploit Status
Exploitation requires knowledge of the vulnerable API endpoint and ability to craft SQL injection payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.2.1
Vendor Advisory: https://www.sunbirddcim.com/
Restart Required: Yes
Instructions:
1. Download Power IQ 9.2.1 from Sunbird website. 2. Backup current configuration. 3. Install the update following vendor documentation. 4. Restart Power IQ services.
🔧 Temporary Workarounds
API Endpoint Restriction
allBlock or restrict access to the vulnerable API endpoint using web application firewall or network controls.
Input Validation Enhancement
allImplement additional input validation at the application layer for array parameters.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Power IQ from untrusted networks.
- Deploy web application firewall with SQL injection protection rules.
🔍 How to Verify
Check if Vulnerable:
Check Power IQ version via web interface or system logs. Version 9.2.0 is vulnerable.Check Version:
Check web interface admin panel or review application logs for version information.Verify Fix Applied:
Confirm Power IQ version is 9.2.1 or later after update.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed API requests with SQL-like patterns
Network Indicators:
- Unusual traffic patterns to Power IQ API endpoints
- Requests containing SQL injection payloads
SIEM Query:
source="poweriq" AND ("sql" OR "syntax" OR "error") AND status=500