A vulnerability was discovered in the detailPlus endpoint of PowerJob servers. An attacker can manipulate the customQuery parameter to inject arbitrary SQL statements, allowing the execution of unintended database commands. Remote attackers could retrieve sensitive data or alter data stored in the back‑end database, compromising confidentiality and integrity.

Version 5.1.0, 5.1.1, and 5.1.2 of the PowerJob platform are affected. All instances that expose the detailPlus endpoint are susceptible, regardless of the deployment environment.

The severity score of 6.9 indicates moderate risk. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires network connectivity to the vulnerable endpoint, and successful exploitation is likely if the server accepts unvalidated SQL fragments. No patch has been officially released by the vendor, but a pull request addressing the issue is available on GitHub, suggesting that a recent revision may contain the fix.