Listen to this Post
The vulnerability exists in Froxlor’s API command `Domains.add()` because the `adminid` parameter is accepted from user input without proper validation when the caller (a reseller) lacks the `customers_see_all` permission. At line 327 of lib/Froxlor/Api/Commands/Domains.php, `$adminid = intval($this->getParam(‘adminid’, true, $this->getUserDetail(‘adminid’)));` reads the parameter. Validation only occurs when `customers_see_all == ‘1’` (lines 410-421). For resellers without this permission, there is no `else` branch to force `$adminid` to the caller’s own admin ID. The unvalidated `$adminid` is then used directly in the domain INSERT (line 757: 'adminid' => $adminid) and in the quota increment (lines 862-868: UPDATE ... SET domains_used = domains_used + 1 WHERE adminid = :adminid). The initial quota check at line 321 examines the caller’s own domains_used, but since the caller’s counter is never incremented (the wrong admin’s counter increments instead), the check passes indefinitely. This allows a reseller to attribute newly created domains to any other admin, bypassing their own quota and potentially exhausting another admin’s quota. The `getCustomerData()` call at line 407 correctly restricts `customerid` to the reseller’s own customers, but it does not prevent spoofing of the `adminid` field itself. The PoC uses a simple curl command to send a `Domains.add` request with a forged `adminid` (e.g., `1` for super-admin). Repeated calls show that the reseller’s `domains_used` remains unchanged while the target admin’s counter increases, enabling unlimited domain creation.
dailycve form:
Platform: Froxlor
Version: Unspecified (≤ affected)
Vulnerability: Quota bypass/DoS
Severity: Medium
date: 2024 (estimated)
Prediction: Patch within 30 days
What Undercode Say:
Check if reseller lacks customers_see_all
mysql -u root -p -e "SELECT adminid, customers_see_all FROM panel_admins WHERE adminid=<reseller_id>;"
Simulate exploit (requires valid reseller API key)
curl -s -u RESELLER_KEY:RESELLER_SECRET -X POST https://froxlor.example/api.php \
-d '{"command": "Domains.add", "params": {"domain": "evil.com", "customerid": 3, "adminid": 1}}'
Verify target admin's domains_used increased
mysql -u root -p -e "SELECT adminid, domains_used FROM panel_admins WHERE adminid=1;"
Monitor for repeated abuse
watch -n 5 'mysql -u root -p -e "SELECT adminid, COUNT() FROM panel_domains GROUP BY adminid;"'
Exploit:
Reseller sends API call with forged `adminid` (e.g., super-admin ID). No `customers_see_all` means no validation. Domain inserted under target admin, target’s `domains_used` incremented. Reseller’s quota unchanged → repeat indefinitely.
Protection from this CVE:
Apply patch adding `else { $adminid = intval($this->getUserDetail(‘adminid’)); }` after line 421 in Domains.php. Alternatively, manually enforce `adminid` to caller’s ID for resellers without customers_see_all. Upgrade to patched version (if released).
Impact:
- Unlimited domain creation (quota bypass)
- DoS by exhausting another admin’s domain quota
- Broken ownership (domains linked to wrong admin)
- Inaccurate billing/resource accounting
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
