UpHeron
All vulnerabilities

Servers and applications

CVE-2024-51567

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6…

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 7 Nov 2024.

Severity
Critical 9.8
Published
29 Oct 2024
Last changed
4 Aug 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.3.8
Sources
NVD

Affected software

SoftwareAffected versions
CyberPanelServers and applications · cpe:a:cyberpanel:cyberpanel
  • Every version before 2.3.8

Known exploited

CISA name
CyberPanel Incorrect Default Permissions Vulnerability
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due for US agencies
28 Nov 2024
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-51567
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-51567