{"uuid": "f41fd396-ca97-472b-ba53-cd06fe74109b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54348", "type": "seen", "source": "https://gist.github.com/alon710/af2c8d3762565eaa4715277e9dc15159", "content": "# CVE-2026-54348: CVE-2026-54348: Second-Order SQL Injection in Froxlor API Layer\n\n> **CVSS Score:** 7.2\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54348\n\n## Summary\nAn authenticated administrator with privileges to manage admin accounts (such as change_serversettings) can execute arbitrary SQL commands via a second-order SQL injection vulnerability. The flaw resides in Froxlor's administrative API endpoints, specifically during the handling of IP address mapping parameters which are stored as serialized arrays and later interpolated without sanitization into active database queries. This vulnerability allows high-privileged administrative attackers to compromise the database. By injecting a payload into administrative profile metadata, an attacker can extract sensitive credentials, manipulate backend settings, or potentially disrupt database integrity. The vulnerability affects all versions of Froxlor prior to 2.3.8.\n\n## TL;DR\nA high-severity second-order SQL injection in Froxlor allows authenticated administrative users to store malicious SQL payloads in admin profiles. When those profiles are queried by specific API actions, the unsanitized payload executes directly against the database, enabling complete database exfiltration. This issue is fully patched in Froxlor version 2.3.8.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 7.2 (High)\n- **EPSS Score**: N/A\n- **Impact**: High (Confidentiality, Integrity, Availability)\n- **Exploit Status**: Proof of Concept (PoC) documented\n- **KEV Status**: Not listed on CISA KEV\n\n## Affected Systems\n\n- Froxlor Server Management Control Panel\n- **Froxlor**: < 2.3.8 (Fixed in: `2.3.8`)\n\n## Mitigation\n\n- Upgrade to Froxlor version 2.3.8 or higher\n- Audit administrative accounts and restrict 'change_serversettings' permissions to highly trusted users\n- Perform manual database queries to audit stored 'panel_admins.ip' parameters for anomalies\n\n**Remediation Steps:**\n1. 1. Back up the existing Froxlor database and configuration files.\n2. 2. Update the Froxlor installation to version 2.3.8 using the official package manager or git repository.\n3. 3. Run database consistency checks to clean up any orphaned or corrupted administrative settings.\n4. 4. Verify the patch is applied by checking that the 'ip' validation functions use 'array_map(\"intval\")' and 'array_filter()'.\n\n## References\n\n- [GHSA-w27m-rmmf-g5w4: Second-order SQL injection in Froxlor API layer](https://github.com/froxlor/froxlor/security/advisories/GHSA-w27m-rmmf-g5w4)\n- [Froxlor Fix Commit a1eaca5a1601c8a30e00814a4fc73ad0c185f89e](https://github.com/froxlor/froxlor/commit/a1eaca5a1601c8a30e00814a4fc73ad0c185f89e)\n- [Froxlor Release 2.3.8](https://github.com/froxlor/froxlor/releases/tag/2.3.8)\n- [NVD - CVE-2026-54348](https://nvd.nist.gov/vuln/detail/CVE-2026-54348)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-54348)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54348) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T13:32:06.783302Z"}