CyberPanel - Command Injection
CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters. References: https://www.rapid7.com/db/modules/exploit/unix/webapp/cyberpanel_preauth_rce_multi_cve/ https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce https://nvd.nist.gov/vuln/detail/CVE-2024-51568 https://cyberpanel.net/blog/cyberpanel-v2-3-5
Used 40 times · 10 assets checked · domain, subdomain, ipv4