Loading vulnerability…
CVE-2024-51567 is a pre-authentication remote command-execution vulnerability in CyberPanel's upgrademysqlstatus handler. The handler accepts a user-controlled statusfile property and unsafely concatenates it into privileged shell commands used to read and remove status files. Its intended POST-request filtering is implemented in secMiddleware, but the handler processes request bodies independently of the HTTP method. An attacker can use a non-POST request to bypass the filter and inject shell metacharacters into the statusfile value. CyberPanel releases through 2.3.6, and unpatched 2.3.7 installations, are affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository purpose: a Python proof-of-concept exploit for CVE-2024-51567 targeting CyberPanel, described as command injection with CSRF protection bypass on the upgrademysqlstatus interface. Structure: - CVE-2024-51567.py: the only code file; implements the exploit. - README.md: Chinese write-up and usage instructions; claims affected versions CyberPanel 2.3.6/2.3.7. - LICENSE: Apache-2.0. - .gitignore: standard Python ignores. Exploit flow (CVE-2024-51567.py): 1) Creates an httpx.Client with base_url set to the provided target and TLS verification disabled (verify=False). 2) get_CSRF_token(): sends GET / and extracts the 'csrftoken' cookie; exits if missing. 3) pwn(): sends a PUT request to /dataBases/upgrademysqlstatus with headers X-CSRFToken and Referer, and a JSON body where 'statusfile' is set to "/dev/null; <cmd>; #" to inject arbitrary shell commands. 4) Interactive loop: prompts for commands ($>), runs exploit per command, and prints the JSON field 'requestStatus' from the server response (so it is command execution-oriented but not a robust output-capturing shell). Capabilities: - Pre-auth network RCE via command injection in a web endpoint parameter. - Automatic CSRF token retrieval and reuse. - Single-target and batch mode (reads targets from a file), with an interactive command prompt per target. Notable limitations/observations: - No explicit authentication handling; relies on the vulnerability being reachable unauthenticated. - Output handling is minimal: prints only response.requestStatus, not stdout/stderr of the executed command. - Disables TLS verification, increasing reach against misconfigured HTTPS but also reducing safety for legitimate testing.
This repository contains a single Metasploit module (Ruby file) that exploits three unauthenticated remote code execution vulnerabilities in CyberPanel, a popular web hosting control panel. The module targets CVE-2024-51567, CVE-2024-51568, and CVE-2024-51378, each corresponding to different HTTP endpoints and injection vectors within CyberPanel. The exploit does not require authentication and can be used against any accessible, vulnerable CyberPanel instance (typically on port 8090 over HTTPS). The module is weaponized, supporting arbitrary command execution via Metasploit's payload system, and is suitable for both proof-of-concept and real-world exploitation. The code is well-structured, leveraging Metasploit's HttpClient and AutoCheck features, and includes logic for detection, exploitation, and payload delivery. The main endpoints targeted are '/dataBases/upgrademysqlstatus', '/filemanager/upload', '/ftp/getresetstatus', and '/dns/getresetstatus'. The module is intended for use by penetration testers and red teamers to demonstrate the impact of these vulnerabilities.
This repository contains a Python proof-of-concept exploit for CVE-2024-51567, a critical command injection vulnerability in CyberPanel versions 2.3.6 and 2.3.7 (unpatched). The exploit targets the '/dataBases/upgrademysqlstatus' HTTP endpoint, which is vulnerable to command injection due to improper filtering of the 'statusfile' parameter and insufficient CSRF protection. The script retrieves a CSRF token from the root endpoint ('/'), then crafts a malicious payload that injects arbitrary shell commands via the 'statusfile' parameter in a PUT request. The exploit supports both single and multiple targets, and provides an interactive shell-like interface for executing commands on the compromised server. The repository consists of the main exploit script (CVE-2024-51567.py) and a detailed README.md explaining the vulnerability, usage, and code structure. No hardcoded IPs or domains are present; the script requires the user to supply target URLs. The exploit is a functional PoC and does not include advanced features such as reverse shells or persistence.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A CyberPanel incorrect default permissions vulnerability whose CISA KEV knownRansomwareCampaignUse field flipped from Unknown to Known (evidence of ransomware campaign use).
A remote code execution vulnerability in CyberPanel that allows attackers to execute arbitrary code on the server.
A vulnerability affecting Craft CMS, details unspecified but likely allows remote exploitation for initial access.
A remote code execution vulnerability in CyberPanel that allows attackers to execute arbitrary code on affected servers.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.