CVE-2024-51567

Deeper analysis

CyberPanel, an open-source web hosting control panel, contains a critical authentication bypass and command injection vulnerability in the upgrademysqlstatus function within databases/views.py. The flaw affects all versions through 2.3.6 and unpatched 2.3.7 prior to commit 5b08cd6, allowing unauthenticated remote attackers to reach the endpoint /dataBases/upgrademysqlstatus. Because secMiddleware is applied only to POST requests, an attacker can submit a GET request containing shell metacharacters in the statusfile parameter to execute arbitrary operating-system commands with the privileges of the CyberPanel process.

An unauthenticated attacker can therefore achieve full remote code execution on the underlying server, including the ability to read or modify hosted data, alter system configurations, or pivot to other assets. The vulnerability carries a CVSS score of 10.0 and is tracked under CWE-306 (Missing Authentication for Critical Function) and related injection weaknesses.

CyberPanel’s official change-log and security advisory describe the issue and direct users to apply the patch released after disclosure; administrators are advised to upgrade immediately to a build containing commit 5b08cd6 or later and to restrict administrative interfaces from untrusted networks until the update is complete.

The flaw was exploited in the wild in October 2024 by the threat actor PSAUX, and the current EPSS of 0.9431 indicates sustained exploitation interest following public disclosure.