upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:* | before 2.3.8 | Vulnerable | CyberPanel |
- cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:* Versions before 2.3.8 Vulnerable ·CyberPanel
Remediation
No fixed version listed by the sources yet.
Timeline
- 2024-11-07 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2024-51567
- 2026-10-03 Alias added: GHSA-w6g2-qqv5-83qj
References
Other 5
- https://cwe.mitre.org/data/definitions/78.html
- https://cyberpanel.net/KnowledgeBase/home/change-logs/
- https://cwe.mitre.org/data/definitions/420.html
- https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel
- https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/
More Cyberpanel vulnerabilities
- TI-2024-34345 getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before… KEVCVSS 3.1CRITICAL 10.0
- TI-2026-30062 CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints CVSS 4.0HIGH 8.8
- TI-2024-34483 CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in… CVSS 3.1CRITICAL 10.0
- TI-2024-35785 CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands… CVSS 3.1HIGH 8.8
- TI-2026-30061 CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard CVSS 4.0MEDIUM 5.3
- TI-2019-09780 An issue was discovered in CyberPanel through 1.8.4. CVSS 3.0HIGH 8.8
Sources
- CVE-2024-51567 · CVE Program
- CVE-2024-51567 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-w6g2-qqv5-83qj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences