{"id":"CVE-2024-51567","title":"upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which i…","summary":"upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which i…","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-306","CWE-306"],"vendor":"cyberpanel","product":"cyberpanel","affected":["cyberpanel < 2.3.8"],"patched":["cyberpanel 2.3.8"],"published":"2024-10-29","updated":"2026-08-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-51567","references":[{"url":"https://cwe.mitre.org/data/definitions/420.html","label":"cve@mitre.org"},{"url":"https://cwe.mitre.org/data/definitions/78.html","label":"cve@mitre.org"},{"url":"https://cyberpanel.net/KnowledgeBase/home/change-logs/","label":"cve@mitre.org"},{"url":"https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel","label":"cve@mitre.org"},{"url":"https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce","label":"cve@mitre.org"},{"url":"https://github.com/usmannasir/cyberpanel/commit/5b08cd6d53f4dbc2107ad9f555122ce8b0996515","label":"cve@mitre.org"},{"url":"https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/","label":"cve@mitre.org"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-51567","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available"],"epss":0.86633,"epssPercentile":0.99731,"kev":true,"kevDateAdded":"2024-11-07","kevDueDate":"2024-11-28","kevRansomware":true,"exploited":true,"zeroDay":true,"ingestedAt":"2026-08-04T05:36:12.574Z","exploits":{"github":3,"githubRepos":["https://github.com/ajayalf/CVE-2024-51567","https://github.com/thehash007/CVE-2024-51567-RCE-EXPLOIT","https://github.com/KKDT12138/cve-2024-51567-poc"],"metasploit":["exploit/unix/webapp/cyberpanel_preauth_rce_multi_cve"],"nuclei":["CVE-2024-51567"],"checkedAt":"2026-09-23T07:13:30.517Z"},"exploitAvailable":true,"slug":"CVE-2024-51567","body":"## Overview\n\nupgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.\n\n## Affected\n\n- `cyberpanel < 2.3.8`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `cyberpanel 2.3.8`","depth":"hadal","depthScore":100,"depthScoreParts":{"impact":55,"likelihood":17.3,"exploitation":25,"ransomware":5},"changes":[{"seq":4739,"id":"CVE-2024-51567","ts":1788887203110,"field":"exploit_available","old":"false","new":"true"},{"seq":3622,"id":"CVE-2024-51567","ts":1788886319270,"field":"exploit_available","old":"true","new":"false"},{"seq":2476,"id":"CVE-2024-51567","ts":1788882987817,"field":"exploit_available","old":"false","new":"true"},{"seq":1505,"id":"CVE-2024-51567","ts":1788882401375,"field":"exploit_available","old":"true","new":"false"},{"seq":619,"id":"CVE-2024-51567","ts":1788881838033,"field":"exploit_available","old":"false","new":"true"}]}