Executive brief
Froxlor is a web hosting control panel that manages customer databases and servers. A flaw in the Mysqls.add API command fails to check whether a customer is authorized to access a particular MySQL server, allowing them to create databases and user accounts on servers they should not have access to—potentially exposing data isolation between customers or accessing premium infrastructure they have not paid for.
Technical details
The vulnerability is an improper authorization (CWE-285) in lib/Froxlor/Api/Commands/Mysqls.php. The add() method accepts a customer-controlled mysql_server parameter and validates only that it is numeric and that the server index exists in the configuration. It never cross-references the allowed_mysqlserver allowlist stored in the customer record, a check that is correctly enforced elsewhere (MysqlServer::get(), MysqlServer::listing(), and the UI). An authenticated customer with API access can invoke Mysqls.add with any configured server index, and the API will create a database and MySQL user with attacker-supplied password on the disallowed server. The database record is then inserted into the panel with the attacker's customerid, granting them persistent access via subsequent API calls (Mysqls.get/update/delete). Fix: Froxlor 2.3.7 and later.
Affected products
- Froxlor Froxlor < 2.3.7
Timeline
- 2026-05-29: disclosed
- 2026-05-29: patched: Froxlor 2.3.7 released