CVE-2024-51567
CyberPanel Incorrect Default Permissions Vulnerability
Published Oct 29, 2024 · updated Aug 3, 2026 · cyberpanel cyberpanel
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Timeline
Detection, updates, and resolution for this record.
Oct 29, 2024 · Catalog
Detected
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and
Nov 7, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Nov 28, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Aug 3, 2026 · Catalog
Updated
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Nov 28, 2024
Affected
- cpe cyberpanel/cyberpanelversion unspecified
- vendor CyberPersons CyberPanelversion unspecified
Sources
- CISA KEVCVE-2024-51567
CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.
cisa.gov - CVE.orgCVE-2024-51567
Official CVE identifier
cve.org - FIRST EPSSCVE-2024-51567
30-day exploitation probability 86.6%
first.org - Metasploit Modulesexploit_unix/webapp/cyberpanel_preauth_rce_multi_cve
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2024-51567
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell
nvd.nist.gov