EIP-2026-113410

PRE-CVE

WHMCompleteSolution (WHMCS) 4.x/5.x - Multiple Web Vulnerabilities

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-113410. PoCs published by AhwAk20o0 --.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in WHMCS v4.x and v5.x, leveraging insufficient input sanitization in the `db_escape_string` function. It includes CSRF-based SQL injection examples to extract admin passwords and convert SQL results into XSS payloads.

Description

WHMCompleteSolution (WHMCS) 4.x/5.x - Multiple Web Vulnerabilities

Exploits (1)

exploitdb WORKING POC VERIFIED
by AhwAk20o0 -- · textwebappsphp
https://www.exploit-db.com/exploits/30246

This exploit demonstrates a SQL injection vulnerability in WHMCS v4.x and v5.x, leveraging insufficient input sanitization in the `db_escape_string` function. It includes CSRF-based SQL injection examples to extract admin passwords and convert SQL results into XSS payloads.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: WHMCS v4.x, v5.x
No auth needed
Prerequisites: Access to WHMCS admin or client interface · CSRF attack vector (e.g., phishing or malicious link)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026