CVE-2026-54348: CVE-2026-54348: Second-Order SQL Injection in Froxlor API Layer

#security #cve #cybersecurity

CVE-2026-54348: Second-Order SQL Injection in Froxlor API Layer

Vulnerability ID: CVE-2026-54348
CVSS Score: 7.2
Published: 2026-08-18

An authenticated administrator with privileges to manage admin accounts (such as change_serversettings) can execute arbitrary SQL commands via a second-order SQL injection vulnerability. The flaw resides in Froxlor's administrative API endpoints, specifically during the handling of IP address mapping parameters which are stored as serialized arrays and later interpolated without sanitization into active database queries. This vulnerability allows high-privileged administrative attackers to compromise the database. By injecting a payload into administrative profile metadata, an attacker can extract sensitive credentials, manipulate backend settings, or potentially disrupt database integrity. The vulnerability affects all versions of Froxlor prior to 2.3.8.

TL;DR

A high-severity second-order SQL injection in Froxlor allows authenticated administrative users to store malicious SQL payloads in admin profiles. When those profiles are queried by specific API actions, the unsanitized payload executes directly against the database, enabling complete database exfiltration. This issue is fully patched in Froxlor version 2.3.8.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-89
Attack Vector: Network (AV:N)
CVSS v3.1: 7.2 (High)
EPSS Score: N/A
Impact: High (Confidentiality, Integrity, Availability)
Exploit Status: Proof of Concept (PoC) documented
KEV Status: Not listed on CISA KEV

Affected Systems

Froxlor Server Management Control Panel
Froxlor: < 2.3.8 (Fixed in: 2.3.8)

Code Analysis

Commit: a1eaca5

Fix second-order SQL injection in API ipaddress handling

@@ -271,6 +271,11 @@ public function add()
                $password = Crypt::validatePassword($password, true);
            }

+           // verify ip-address ids are numeric values only
+           if (is_array($ipaddress)) {
+               $ipaddress = array_filter($ipaddress, 'is_numeric');
+           }
+
            $diskspace *= 1024;
            $traffic *= 1024 * 1024;

@@ -355,7 +360,9 @@ public function add()
                    'quota' => $email_quota,
                    'ftps' => $ftps,
                    'mysqls' => $mysqls,
-                   'ip' => empty($ipaddress) ? "" : (is_array($ipaddress) && $ipaddress > 0 ? json_encode($ipaddress) : -1),
+                   'ip' => empty($ipaddress) ? "" : (is_array($ipaddress) && count($ipaddress) > 0
+                       ? json_encode(array_map('intval', $ipaddress))
+                       : -1),

Exploit Details

GitHub Security Advisory: Detailed explanation of the second-order vulnerability mechanics.

Mitigation Strategies

Upgrade to Froxlor version 2.3.8 or higher
Audit administrative accounts and restrict 'change_serversettings' permissions to highly trusted users
Perform manual database queries to audit stored 'panel_admins.ip' parameters for anomalies

Remediation Steps:

1. Back up the existing Froxlor database and configuration files.
2. Update the Froxlor installation to version 2.3.8 using the official package manager or git repository.
3. Run database consistency checks to clean up any orphaned or corrupted administrative settings.
4. Verify the patch is applied by checking that the 'ip' validation functions use 'array_map("intval")' and 'array_filter()'.

References

Read the full report for CVE-2026-54348 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community