Compliance Impact

The vulnerability CVE-2026-5736 allows unauthenticated remote code execution via SQL injection in PowerJob versions 5.1.0 to 5.1.2. This security flaw can lead to unauthorized access and manipulation of sensitive data, which may result in violations of data protection regulations such as GDPR and HIPAA.

Specifically, the lack of authentication and permission checks on a sensitive API endpoint combined with insufficient SQL injection filtering can enable attackers to execute arbitrary system commands remotely. Such unauthorized access and potential data breaches undermine the confidentiality, integrity, and availability of protected data, core principles required by compliance standards.

Therefore, organizations using affected versions of PowerJob without applying the recommended patches risk non-compliance with regulations that mandate strict access controls and protection against unauthorized data access or modification.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-5736 is a critical vulnerability in PowerJob versions 5.1.0 through 5.1.2 that allows unauthenticated remote code execution via SQL injection. The vulnerability arises from two main issues in the `/instance/detailPlus` API endpoint: first, the `getInstanceDetailPlus` method lacks authentication and permission checks, allowing anyone to access it without credentials; second, the `customQuery` parameter is vulnerable to SQL injection because the blacklist filtering dangerous SQL keywords is incomplete and misses critical H2 database commands like RUNSCRIPT, CALL, LINK, and SCRIPT.

Attackers can exploit this by sending specially crafted SQL commands through the `customQuery` parameter, which the H2 database engine executes. This can lead to arbitrary code execution on the server, including running remote scripts and system commands. The vulnerability is exacerbated by the fact that the endpoint does not enforce permission checks, and the blacklist filtering is based on simple substring matching, which can be bypassed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to remotely execute arbitrary system commands on the server running PowerJob. This can lead to full compromise of the affected system, including unauthorized data access, data modification, service disruption, and potential lateral movement within the network.

Specifically, attackers can inject malicious SQL commands that execute remote scripts and create aliases to run system commands, effectively gaining control over the server environment without any authentication.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying unauthorized access attempts to the `/instance/detailPlus` API endpoint and monitoring for suspicious SQL injection payloads in the `customQuery` parameter.

Specifically, look for POST requests to `/instance/detailPlus` containing SQL keywords such as RUNSCRIPT, CALL, LINK, or SCRIPT within the `customQuery` parameter, which are indicators of attempted exploitation.

Network or application logs can be searched for these patterns. For example, using command-line tools like grep on server logs:

• grep -iE 'POST /instance/detailPlus' /path/to/access.log | grep -iE 'runscript|call|link|script'
• grep -iE 'customQuery=.*(runscript|call|link|script)' /path/to/application.log

Additionally, monitoring for unauthenticated access to this endpoint is important since the vulnerability allows pre-authentication exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the patches that add authentication and authorization checks to the `/instance/detailPlus` endpoint and extending the SQL injection blacklist.

• Add the `@ApiPermission` annotation to the `getInstanceDetailPlus` method to enforce permission checks, requiring appropriate roles and permissions.
• Extend the SQL injection blacklist for the `customQuery` parameter to include H2-specific dangerous keywords such as RUNSCRIPT, CALL, LINK, and SCRIPT.

Furthermore, consider restricting the allowed SQL grammar in `customQuery` to a safe subset, disallowing statement separators and SQL comment syntax to reduce injection risk.

If patches are not immediately available, restrict network access to the vulnerable endpoints and monitor for suspicious activity as a temporary measure.

Useful 0 Not Useful 0