Vulnerability — CVE-2024-51567

CVE-2024-51567

Reference to the description:: https://nvd.nist.gov/vuln/detail/CVE-2024-51567
Description:: upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Last updated date:: 11/08/2024

ACTIVELY EXPLOITED

Type:: exploitation
Confidence:: HIGH
Date of publishing:: 10/29/2024
Reference url to background: https://nvd.nist.gov/vuln/detail/CVE-2024-51567

Type:: exploitation
Confidence:: HIGH
Date of publishing:: 11/07/2024
Reference url to background: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Type:: exploit
Confidence:: HIGH
Date of publishing:: 11/08/2024
Reference url to background: https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce