Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with `change_serversettings` permission adds or updates a MySQL server via the API, the `privileged_user` parameter (which has no input validation) is written unescaped into `lib/userdata.inc.php`. Since this file is `require`d on every request via `Database::getDB()`, an attacker can inject arbitrary PHP code that executes as the web server user on every subsequent page load. Version 2.3.6 contains a patch.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HFroxlor
APPFroxlor< 2.3.6
Related vulnerabilities
Froxlor: RCE przez path traversal w parametrze def_language
RCE z uprawnieniami root w Froxlor przez błąd walidacji pól e-mail
Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0.
Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20...
Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.