kkdt12138/cve-2024-51567-pocCVE-2024-51567 is a Python PoC exploit targeting an RCE vulnerability in CyberPanel v2.3.6’s upgrademysqlstatus endpoint, bypassing CSRF protections.
upgrademysqlstatus endpoint of CyberPanel, by bypassing the secMiddleware protection for POST requests, an attacker can exploit the statusfile parameter to inject commands and execute them remotely.httpx moduleClone the project and install dependencies
git clone https://github.com/XiaomingX/cve-2024-51567-poc.git
cd cve-2024-51567-poc
pip install httpx
Single-target execution
python CVE-2024-51567.py <target URL>
Example:
python CVE-2024-51567.py http://example.com
Multi-target batch execution
List all targets in a file, one URL per line, then run:
python CVE-2024-51567.py <target file>
Example:
python CVE-2024-51567.py targets.txt
After running the script, it enters interactive mode, allowing you to continuously input commands until you exit (enter exit or quit).
get_CSRF_token function.