Executive brief
Froxlor, a web hosting control panel, contains a second-order SQL injection vulnerability in its admin API. An authenticated administrator can store a malicious SQL payload by creating or editing an admin account, then trigger it when viewing IP and port listings to extract all administrator login credentials and password hashes from the database. This allows one compromised or malicious admin to steal credentials of all other administrators and escalate privileges to full control of the hosting panel.
Technical details
The vulnerability is a second-order SQL injection spanning two code paths: Stage 1 stores an unsanitized array in the panel_admins.ip column via Admins.add/update by JSON-encoding attacker-supplied IP address values without validation; Stage 2 retrieves and implodes this JSON array directly into a WHERE IN clause in IpsAndPorts.listing without type casting or escaping, allowing UNION-based SQL injection. An authenticated admin with change_serversettings=1 can craft a malicious ipaddress array parameter containing SQL syntax (e.g., "1) UNION SELECT 1,loginname,password,...FROM panel_admins-- -"), which is stored as JSON. When any account (including the poisoned account itself) calls IpsAndPorts.listing, the imploded payload executes, leaking administrator credentials. The same pattern exists in Domains.php:1016. Patches cast array elements to integers via array_map('intval',...) before implode, or validate input at storage time in Admins.add/update.
Affected products
- Froxlor Froxlor < 2.3.8
Timeline
- 2026-06-29: disclosed
- 2026-06-29: patched: Fixed in version 2.3.8
- 2026-08-18: advisory