Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with `change_serversettings` permission adds or updates a MySQL server via the API, the `privileged_user` parameter (which has no input validation) is written unescaped into `lib/userdata.inc.php`. Since this file is `require`d on every request via `Database::getDB()`, an attacker can inject arbitrary PHP code that executes as the web server user on every subsequent page load. Version 2.3.6 contains a patch.
The `PhpHelper::parseArrayToString()` function writes text values to single-quoted PHP literals without escaping special characters (no apostrophe escaping). The `privileged_user` parameter passed through the API is not subject to any input validation, and its value goes directly to the `lib/userdata.inc.php` file. This file is included (with the `require` instruction) with every request by the `Database::getDB()` method, causing the injected PHP code to be executed automatically as the web server process user with every subsequent page load.
An attacker can execute arbitrary PHP code with the privileges of the web server process (RCE), which may lead to full server compromise, data theft, configuration modification, or backdoor installation.
Froxlor should be immediately updated to version 2.3.6, which contains a patch eliminating the vulnerability. The patch is available in the GitHub repository (commit 3589ddf93ab59eb2a8971f0f56cbf6266d03c4ae) and in the official release 2.3.6.
Froxlor in all versions prior to 2.3.6. An administrator account with `change_serversettings` permission is required.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HFroxlor
APPFroxlor< 2.3.6
Related vulnerabilities
Froxlor: RCE przez path traversal w parametrze def_language
RCE z uprawnieniami root w Froxlor przez błąd walidacji pól e-mail
Nieprawidłowe rozwiązywanie dowiązań symbolicznych w Froxlor (path traversal via symlink)
Brak ograniczeń prób uwierzytelnienia w Froxlor (brute-force)
Obejście uwierzytelnienia w Froxlor poprzez Primary Weakness