CVE-2024-51567

The vulnerability in CyberPanel arises from a flaw in the `upgrademysqlstatus` function located in the databases/views.py file. This issue allows remote attackers to bypass authentication mechanisms and execute arbitrary commands on the server. The root cause lies in the improper handling of requests, specifically the reliance on a security middleware that only applies to POST requests. By crafting a specially formatted request that utilizes shell metacharacters in the `statusfile` property, an attacker can exploit this vulnerability to gain unauthorized access and execute commands with the privileges of the application. The flaw is particularly critical due to its high CVSS score, indicating a severe risk to affected systems.

Attack vectors for this vulnerability are straightforward, allowing for exploitation through crafted HTTP requests. An attacker can send a GET request to the vulnerable endpoint, circumventing the intended authentication checks. This method of exploitation is particularly insidious as it does not require any prior access to the system, making it accessible to any remote adversary. Once the attacker successfully executes arbitrary commands, they can manipulate the server environment, potentially leading to data breaches, system compromise, or further lateral movement within the network. The exploitation has already been observed in the wild, highlighting the urgency for organizations to address this vulnerability.

The real-world impact of this vulnerability can be significant, particularly for businesses relying on CyberPanel for web hosting and database management. Unauthorized command execution can lead to data loss, service disruption, and reputational damage. Organizations may face regulatory scrutiny if sensitive data is exposed or compromised due to this vulnerability. The potential for financial loss is amplified by the costs associated with incident response, recovery, and potential legal liabilities. As the threat landscape continues to evolve, the implications of such vulnerabilities underscore the importance of maintaining robust security practices.

To detect and mitigate this vulnerability, organizations should implement a multi-faceted approach. Regularly updating CyberPanel to the latest version is crucial, as patches are released to address known vulnerabilities. Additionally, employing web application firewalls (WAFs) can help filter out malicious requests before they reach the application. Monitoring logs for unusual activity, such as unexpected command executions or anomalous request patterns, can aid in early detection of exploitation attempts. Furthermore, conducting regular security assessments and penetration testing can help identify and remediate vulnerabilities before they can be exploited by malicious actors.

In conclusion, the vulnerability in CyberPanel presents a serious risk to organizations that utilize this platform for their web hosting and database management needs. The ability for remote attackers to bypass authentication and execute arbitrary commands can lead to severe consequences, including data breaches and operational disruptions. By understanding the technical details, potential attack vectors, and real-world impacts, organizations can better prepare themselves to detect and mitigate this threat effectively. Proactive security measures, including timely updates and vigilant monitoring, are essential to safeguarding against such vulnerabilities in an increasingly complex threat landscape.

CSURFACE threat intelligence has detected a notable surge in exploitation attempts targeting CVE-2024-51567, indicating increased adversary focus on this critical CyberPanel vulnerability. This escalation is accompanied by the emergence of additional proof-of-concept exploits circulating publicly, which lowers the barrier for threat actors to weaponize the flaw. Our telemetry also confirms continued use of this vulnerability in ransomware campaigns, particularly by the PSAUX group, underscoring its operational relevance in active attacks. Although the EPSS score remains high and stable, the uptick in exploitation activity elevates the immediate risk to organizations running vulnerable CyberPanel versions. Defenders should regard this as a heightened threat environment where successful exploitation can lead to severe operational disruption and data compromise.

Update 2 — May 20, 2026

CSURFACE threat intelligence has identified a recalibration of the CVSS score for CVE-2024-51567 from 9.8 to a maximum severity of 10.0, reflecting a refined understanding of its criticality given the vulnerability’s unauthenticated remote code execution capabilities. Concurrently, our telemetry indicates a significant reduction in exploitation attempts, suggesting either partial mitigation efforts or shifting attacker focus. Despite this decline, the vulnerability remains actively exploited in ransomware campaigns, notably by the PSAUX group, maintaining its operational relevance. The stable EPSS score near the highest percentile confirms persistent exploitability and risk. This duality—reduced detection frequency but unchanged exploit potency—underscores a nuanced threat landscape where defenders cannot afford complacency. The elevation to a perfect CVSS score signals that successful exploitation continues to pose an extreme risk of system compromise and operational disruption. Organizations running vulnerable CyberPanel versions remain prime targets, and the presence of multiple proof-of-concept exploits in the wild continues to lower the barrier for adversaries. Overall, the threat level remains critical, with a subtle shift towards stealthier or more selective exploitation patterns.

Update 3 — June 07, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation activity targeting CVE-2024-51567, evidenced by a notable surge in detection events and the emergence of multiple new proof-of-concept exploits circulating on public repositories. This broadened exploit landscape includes refined tools that facilitate bypassing existing protections more reliably, increasing the ease with which threat actors—particularly ransomware groups like PSAUX—can leverage this vulnerability for remote code execution. Although the CVSS score was adjusted slightly downward to 9.8, this reflects a more precise assessment rather than a reduction in threat severity. The sustained high EPSS score and stable exploitation trends underscore that the vulnerability remains a critical risk, with adversaries actively integrating these exploits into their operational toolkits. For defenders, this development signals an urgent need to maintain heightened vigilance and prioritize detection capabilities, as the attack surface is expanding and exploitation attempts are becoming more frequent and sophisticated.

Update 4 — July 05, 2026

CSURFACE threat intelligence has detected a notable surge in exploitation attempts targeting CVE-2024-51567, reflecting a growing adversary focus on this critical CyberPanel vulnerability. Our telemetry indicates that attackers are increasingly leveraging publicly available proof-of-concept exploits, including those integrated into popular penetration testing frameworks, to bypass authentication and execute arbitrary commands remotely. This uptick coincides with continued ransomware campaigns attributed to the PSAUX group, which remains the primary actor exploiting this flaw at scale. The persistence and expansion of these attacks underscore the vulnerability’s active weaponization and the sustained interest from threat actors in compromising CyberPanel instances. Consequently, the risk level associated with CVE-2024-51567 remains critically high, with the evolving exploitation landscape demanding ongoing attention from defenders to detect and respond to increasingly frequent and sophisticated intrusion attempts.