CVE-2024-51378

CyberPanel 命令注入漏洞 - CVE-2024-51378 针对 CyberPanel 预认证 RCE（远程代码执行）的命令注入漏洞利用 作者： Luka Petrovic refr4g 披露日期： 2024 年 10 月 概述 针对 CyberPanel 中命令注入漏洞（CVE-2024-51378）的概念验证（PoC）利用代码。该漏洞允许未认证的攻击者通过向 /dns/getresetstatus 和 /ftp/getresetstatus 端点发送精心构造的 OPTIONS HTTP 请求，在易受攻击的服务器上注入并执行任意命令，可能导致系统完全沦陷。 影响 能够通过网络...

The vulnerability of the getresetstatus function in the CyberPanel web hosting control panel allows a hacker to execute arbitrary commands.

The vulnerability of the getresetstatus function in the CyberPanel web hosting control panel’s views.py and ftp.views.py files is related to the improper use of standard permissions. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

CyberPanel 安全漏洞

CyberPanel is a web hosting control panel with built-in DNS and email servers by Usman Nasir, an individual developer. CyberPanel has a security vulnerability that originates from getresetstatus in dns/views.py that allows remote attackers to bypass authentication and execute arbitrary commands v...

CVE-2024-51378

getresetstatus in dns/views.py and ftp/views.py in CyberPanel aka Cyber Panel before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware which is only for a POST request and using shell...

CVE-2024-51378

CyberPanel CVE-2024-51378 is an unauthenticated remote code execution affecting CyberPanel before patch 1c0c6cb (versions through 2.3.6 and unpatched 2.3.7). The vulnerability lies in getresetstatus endpoints at /dns/getresetstatus and /ftp/getresetstatus, where an attacker can bypass secMiddlewa...