THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2024-51567 (CRITICAL 10.0) — upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell

[NVD] CVE-2024-51567 (CRITICAL 10.0) — upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell

lownvdPublished 2024-10-29

CVE-2024-51567 CVSS: 10.0 CRITICAL Published: 2024-10-29T23:15:04.307

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exp

Indicators of compromise

CVE-2024-51567cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2024-51567