CVE-2026-54348

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.8

Description An authenticated administrator with change serversettings permission can perform a SQL injection attack. The 'Admins.add' and 'Admins.update' endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in panel admins.ip without enforcing numeric element types. When the affected account subsequently calls 'IpsAndPorts.listing' in lib/Froxlor/Api/Commands/IpsAndPorts.php or functions within lib/Froxlor/Api/Commands/Domains.php, the array is decoded and concatenated into a SQL IN clause without casting or parameterization. This allows the use of a UNION-based payload to retrieve arbitrary database information, such as administrator login names and bcrypt password hashes, potentially leading to privilege escalation.

Recommendations Update to version 2.3.8.