CVE-2024-51567

CVE-2024-51567 is a critical authentication bypass vulnerability in CyberPanel versions through 2.3.6 and unpatched 2.3.7. It allows remote attackers to execute arbitrary commands by bypassing security middleware in the upgrademysqlstatus function via shell metacharacters in the statusfile property. With a CVSS score of 9.8 (CRITICAL), this vulnerability poses a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. This flaw is actively exploited in the wild, notably by the PSAUX ransomware group, and has readily available exploit modules in Metasploit and Nuclei, leading to significant community discussion and media coverage.