CVE-2026-54348: Froxlor second-order SQL injection in IpsAndPorts.listing

CVE-2026-54348 · Severity: high · CVSS 7.2 · Published 2026-08-18

Froxlor, a web hosting control panel, contains a second-order SQL injection vulnerability in its admin API. An authenticated administrator can store a malicious SQL payload by creating or editing an admin account, then trigger it when viewing IP and port listings to extract all administrator login credentials and password hashes from the database. This allows one compromised or malicious admin to steal credentials of all other administrators and escalate privileges to full control of the hosting panel.

Technologies: Froxlor, froxlor/froxlor (Packagist). Vendors: Froxlor, Packagist.

Quick answers

Is CVE-2026-54348 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54348 being exploited in the wild.
How severe is CVE-2026-54348?
High severity, with a CVSS score of 7.2, published 18 August 2026.
Which products and versions are affected?
Froxlor < 2.3.8; froxlor/froxlor (Packagist) < 2.3.8, ECOSYSTEM:introduced=0,fixed=2.3.8.
Is there a fix for CVE-2026-54348?
Yes. froxlor/froxlor (Packagist): upgrade to 2.3.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54348 attacked?
It is attacked over the network.
Am I affected by CVE-2026-54348?
Check whether you run Froxlor or froxlor/froxlor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • froxlor/froxlor (Packagist): upgrade to 2.3.8 or later
    composer require froxlor/froxlor:^2.3.8

Technical details

The vulnerability is a second-order SQL injection spanning two code paths: Stage 1 stores an unsanitized array in the panel_admins.ip column via Admins.add/update by JSON-encoding attacker-supplied IP address values without validation; Stage 2 retrieves and implodes this JSON array directly into a WHERE IN clause in IpsAndPorts.listing without type casting or escaping, allowing UNION-based SQL injection. An authenticated admin with change_serversettings=1 can craft a malicious ipaddress array parameter containing SQL syntax (e.g., "1) UNION SELECT 1,loginname,password,...FROM panel_admins-- -"), which is stored as JSON. When any account (including the poisoned account itself) calls IpsAndPorts.listing, the imploded payload executes, leaking administrator credentials. The same pattern exists in Domains.php:1016. Patches cast array elements to integers via array_map('intval',...) before implode, or validate input at storage time in Admins.add/update.

Affected products

  • Froxlor Froxlor < 2.3.8

Identifiers

  • CVE-2026-54348
  • GHSA-w27m-rmmf-g5w4

Timeline

  • 2026-06-29: disclosed
  • 2026-06-29: patched: Fixed in version 2.3.8
  • 2026-08-18: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.