CVE-2024-56112: CyberPanel XSS Vulnerability

CVE-2024-56112 Overview

CVE-2024-56112 is a reflected Cross-Site Scripting (XSS) vulnerability in CyberPanel, an open-source web hosting control panel. The flaw exists in plogical/phpmyadminsignin.php, where the token and username POST parameters are consumed without proper output encoding. An attacker can craft a malicious request that injects arbitrary JavaScript into the response, executing in the victim's browser session when the victim is lured into submitting it.

The issue is tracked under CWE-79 and was fixed in commit f0cf648. CyberPanel installations prior to this commit are affected.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in an authenticated administrator's browser, potentially leading to session hijacking, credential theft, or unauthorized actions within the CyberPanel control panel.

Affected Products

CyberPanel (all versions before commit f0cf648)
CyberPanel plogical/phpmyadminsignin.php component
Deployments exposing the phpMyAdmin single sign-on endpoint to untrusted networks

Discovery Timeline

2024-12-16 - CVE-2024-56112 published to NVD
Commit f0cf648 - CyberPanel maintainer releases patch to plogical/phpmyadminsignin.php
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56112

Vulnerability Analysis

The vulnerability resides in the phpMyAdmin sign-in bridge shipped with CyberPanel. The script plogical/phpmyadminsignin.php receives the token and username values from a POST request and reflects them into the rendered HTML response without sanitization or context-aware encoding. Because the parameters are echoed into the page, an attacker can supply payloads containing HTML or JavaScript syntax that the browser then parses and executes.

The attack requires user interaction, as the victim must be induced to submit a crafted form or follow a specially prepared link. Since CyberPanel is a privileged administration interface, script execution in the victim's browser inherits the administrator's authenticated context, enabling actions against the control panel and any hosted databases reachable through phpMyAdmin.

Root Cause

The root cause is missing output encoding on user-controlled input. The pre-patch code assigned $_POST['token'] and $_POST['username'] directly to variables that were later embedded in HTML. The patch introduces htmlspecialchars() with ENT_QUOTES and UTF-8 encoding to neutralize HTML metacharacters before rendering.

Attack Vector

An attacker crafts a page or link that submits a POST request to the target CyberPanel phpmyadminsignin.php endpoint with a JavaScript payload in token or username. When an authenticated CyberPanel administrator triggers the submission, the reflected payload executes in the administrator's browser. The scope change indicated in the CVSS vector reflects that impact extends beyond the vulnerable component into the administrator's authenticated session and adjacent browser contexts.

php

// Security patch in plogical/phpmyadminsignin.php
// Before (vulnerable):
$token = $_POST['token'];
$username = $_POST['username'];

// After (patched in commit f0cf648):
$token = htmlspecialchars($_POST['token'], ENT_QUOTES, 'UTF-8');
$username = htmlspecialchars($_POST['username'], ENT_QUOTES, 'UTF-8');

//$url = "/dataBases/fetchDetailsPHPMYAdmin?token=" . $token . '&username=' . $username;
$url = "/dataBases/fetchDetailsPHPMYAdmin";

Source: CyberPanel commit f0cf648

Detection Methods for CVE-2024-56112

Indicators of Compromise

POST requests to /plogical/phpmyadminsignin.php containing HTML tags, <script>, javascript:, or event handlers such as onerror= and onload= inside the token or username parameters.
Web server access logs showing unusual referrers or off-domain sources submitting to the phpMyAdmin sign-in endpoint.
CyberPanel admin sessions performing unexpected privileged actions shortly after visiting external links.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule to inspect token and username POST fields for angle brackets, quote characters, and known XSS payload signatures.
Baseline the CyberPanel version in use and alert when any host reports a commit hash earlier than f0cf648.
Correlate browser telemetry showing script execution originating from CyberPanel admin URLs with recent inbound HTTP POSTs to phpmyadminsignin.php.

Monitoring Recommendations

Enable verbose HTTP access logging on the CyberPanel front-end and forward it to a centralized analytics platform for retention and query.
Monitor egress traffic from administrator workstations for beacons to unfamiliar domains following CyberPanel activity.
Track authentication events and configuration changes in CyberPanel to identify actions performed without a corresponding operator-driven session.

How to Mitigate CVE-2024-56112

Immediate Actions Required

Upgrade CyberPanel to a build that includes commit f0cf648 or later.
Restrict access to the CyberPanel administrative interface using network ACLs, VPN, or IP allowlists so the endpoint is not exposed to the public internet.
Instruct administrators to avoid clicking untrusted links while authenticated to CyberPanel and to use dedicated browser profiles for administrative work.

Patch Information

The fix is available in the upstream repository at CyberPanel commit f0cf648. The patch wraps both $_POST['token'] and $_POST['username'] with htmlspecialchars() using ENT_QUOTES and UTF-8 encoding. Refer to the CyberPanel official website for release channels and upgrade instructions.

Workarounds

Apply the two-line change from commit f0cf648 directly to plogical/phpmyadminsignin.php if an immediate full upgrade is not possible.
Block or restrict access to /plogical/phpmyadminsignin.php at the reverse proxy or WAF layer until the patch is applied.
Enforce a strict Content Security Policy (CSP) on the CyberPanel domain to reduce the impact of reflected script execution.

bash

# Example Nginx snippet to restrict the vulnerable endpoint to trusted IPs
location = /plogical/phpmyadminsignin.php {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://cyberpanel_backend;
}

# Verify the installed CyberPanel commit
cd /usr/local/CyberCP && git log -1 --pretty=format:'%H %s'