CVE-2024-51567

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-51567
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://cwe.mitre.org/data/definitions/420.html Technical Description
https://cwe.mitre.org/data/definitions/78.html Technical Description
https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel Product
https://cyberpanel.net/KnowledgeBase/home/change-logs/ Release Notes
https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce Exploit Patch
https://github.com/usmannasir/cyberpanel/commit/5b08cd6d53f4dbc2107ad9f555122ce8b0996515 Patch
https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/ Press/Media Coverage
Configurations

Configuration 1 (hide)

cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*
History

08 Nov 2024, 21:14

Type Values Removed Values Added
First Time Cyberpanel cyberpanel
Cyberpanel
References () https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/ - () https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/ - Press/Media Coverage
References () https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce - () https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce - Exploit, Patch
References () https://cwe.mitre.org/data/definitions/78.html - () https://cwe.mitre.org/data/definitions/78.html - Technical Description
References () https://cyberpanel.net/KnowledgeBase/home/change-logs/ - () https://cyberpanel.net/KnowledgeBase/home/change-logs/ - Release Notes
References () https://github.com/usmannasir/cyberpanel/commit/5b08cd6d53f4dbc2107ad9f555122ce8b0996515 - () https://github.com/usmannasir/cyberpanel/commit/5b08cd6d53f4dbc2107ad9f555122ce8b0996515 - Patch
References () https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel - () https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel - Product
References () https://cwe.mitre.org/data/definitions/420.html - () https://cwe.mitre.org/data/definitions/420.html - Technical Description
CWE CWE-306
CPE cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

29 Oct 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-29 23:15

Updated : 2025-04-03 20:40

NVD link : CVE-2024-51567

Mitre link : CVE-2024-51567

JSON object : View

Products Affected

cyberpanel

  • cyberpanel
CWE
CWE-306

Missing Authentication for Critical Function