Jenderal92/CVE-2026-41940

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 2.7 script that performs a multi-stage authentication bypass against WHM/cPanel (CVE-2026-41940) using CRLF injection, then changes the root password to 'Jenderal92' on successfully exploited targets.

Backdoor review

No backdoor observed in reviewed code

The PoC is a Python 2.7 script that exploits CVE-2026-41940, an authentication bypass in WHM/cPanel. It performs a multi-stage attack to gain root access and then changes the root password to a hardcoded value ('Jenderal92'). The script's behavior is fully disclosed in the README and source code. All network actions target the operator-supplied remote hosts; no local persistence, data exfiltration to third parties, or concealed unrelated payloads were found. The hardcoded password and output format are transparently described.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwarecPanelWHM
Attack typesauthentication bypassCRLF injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively performs a multi-stage attack to bypass authentication and then changes the root password on the target system. This is exploitation, not merely detection or scanning.

CVE-2026-41940.py:233-238CVE-2026-41940.py:276-353

Requirements

  • Target must be running a vulnerable version of WHM/cPanel on port 2087 (or a specified port).CVE-2026-41940.py:34-47
  • The script requires Python 2.7 and the 'requests', 'urllib3', and 'futures' packages.requirements.txt:1-3

Observed behavior

  • Sends a POST request to /login/?login_only=1 with invalid credentials to obtain a whostmgrsession cookie.CVE-2026-41940.py:93-120
  • Sends a GET request with a malicious Authorization header containing a Base64-encoded CRLF injection payload to inject fake session parameters.CVE-2026-41940.py:122-143
  • Accesses /scripts2/listaccts to trigger the do_token_denied mechanism and propagate the injected session.CVE-2026-41940.py:145-162
  • Verifies root access by calling /json-api/version, then calls /json-api/passwd to change the root password to 'Jenderal92'.CVE-2026-41940.py:164-274
  • Saves successfully exploited targets (host:port|root|Jenderal92) to res.txt.CVE-2026-41940.py:391-399
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Password
Jenderal92The exploit changes the root password of the target WHM/cPanel server to this value. This is the disclosed payload of the exploit.CVE-2026-41940.py:237README.md:21
Output File
res.txtThe script writes successfully exploited targets in the format 'domain:port|root|Jenderal92' to this local file. This is the disclosed output mechanism.CVE-2026-41940.py:396-398
Exploit Stages
Pre-auth session, CRLF injection, session propagation, verification, password changeThe exploit follows a documented 4-stage process to bypass authentication and change the root password on the target.README.md:217-267
Review boundaries

What the analysis did not establish

  • The evidence packet contains only the three text files from the repository snapshot; no binary files or external dependencies were inspected.
  • The analysis is based solely on static review of the provided source code; the code was not executed, and its actual behavior on a live target is not verified.
  • Only the three text files in the repository were reviewed; no compiled binaries or external dependencies were inspected.
  • The review does not assess the validity or safety of the exploit against any specific target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1