Remote Command Execution Vulnerability in CyberPanel

CVE-2024-53376

Currently unrated 🤨

Key Information

Vendor
CyberPanel
Vendor
CVE Published:
16 December 2024

Badges

👾 Exploit Exists🔴 Public PoC

Summary

CVE-2024-53376 is a critical remote code execution vulnerability affecting CyberPanel versions before 2.3.8. This flaw allows authenticated users to execute arbitrary commands on the server by manipulating the phpSelection field in the websites/submitWebsiteCreation URI. The vulnerability arises from inadequate input validation, which enables attackers with valid credentials to leverage shell metacharacters to compromise the server. This poses an urgent threat, as it can lead to unauthorized access and control over the affected systems.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-53376
Created by ThottySploity

Refferences

https://github.com/ThottySploity/CVE-2024-53376
https://thottysploity.github.io/posts/cve-2024-53376
https://github.com/ThottySploity/CVE-2024-53376/blob/aa30...

Timeline

  • 🔴

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database1 Proof of Concept(s)
.