CVE-2026-54348: Second-Order SQL Injection in Froxlor API Layer

Froxlor is an open-source server administration control panel used to manage hosting environments. It exposes an API layer for administrative operations, including system configuration, database administration, and user management. This wide attack surface relies heavily on role-based access controls to isolate different tiers of administrative users.

This vulnerability, tracked as CVE-2026-54348 and GHSA-w27m-rmmf-g5w4, represents a classic trust-boundary violation. It falls under the class of second-order SQL injection (CWE-89). In this class, user input is initially stored safely in a database, only to be retrieved and executed insecurely in a different context or workflow later on.

The vulnerability allows high-privileged administrative attackers to compromise the database. By injecting a payload into administrative profile metadata, an attacker can extract sensitive credentials, manipulate backend settings, or potentially disrupt database integrity. The vulnerability affects all versions of Froxlor prior to 2.3.8.

The root cause of this vulnerability lies in the lack of data-type validation and strict boundary separation when processing array parameters. Specifically, the API endpoints Admins.add and Admins.update accept an arbitrary array under the ipaddress parameter. The application attempts to serialize this array into a JSON string using json_encode() and write it to the panel_admins.ip column.

During this initial write operation, the application performs a weak check: is_array($ipaddress) && $ipaddress > 0. In PHP, checking if an array is greater than zero simply verifies that the array has one or more elements. It does not validate or sanitize the types of the elements contained within the array itself. Consequently, arbitrary string inputs (including SQL operators and keywords) are successfully stored in the database as a valid JSON array.

The injection payload becomes active during read operations performed by endpoints such as IpsAndPorts.listing and domain validation logic. The application retrieves the JSON string from the database, decodes it back into a PHP array using json_decode(), and directly concatenates the raw array values into an SQL query's IN clause using the PHP implode() function. Because the values are directly concatenated rather than bound as parameterized variables or cast to integers, the interpreter treats the injected strings as structured SQL commands.

To analyze the vulnerable implementation, consider how the ipaddress parameter was processed in lib/Froxlor/Api/Commands/Admins.php prior to the patch. The array was encoded directly without ensuring its keys or values were restricted to numeric identifiers:

// Vulnerable code in lib/Froxlor/Api/Commands/Admins.php
'ip' => empty($ipaddress) ? '' : (is_array($ipaddress) && $ipaddress > 0 ? json_encode($ipaddress) : -1)

When reading this data, lib/Froxlor/Api/Commands/IpsAndPorts.php executed the following unsafe dynamic SQL construction:

// Vulnerable query interpolation in lib/Froxlor/Api/Commands/IpsAndPorts.php
if (!empty($this->getUserDetail('ip')) && $this->getUserDetail('ip') != -1) {
    $ip_where = 'WHERE id IN (' . implode(', ', json_decode($this->getUserDetail('ip'), true)) . ')';
    $append_where = true;
}

The patch in commit a1eaca5a1601c8a30e00814a4fc73ad0c185f89e addresses this on both the write and read paths. On the write path, the application now enforces that elements must be numeric using array_filter() and explicitly casts elements to integers with array_map('intval') before serialization:

// Patched code in lib/Froxlor/Api/Commands/Admins.php
if (is_array($ipaddress)) {
    $ipaddress = array_filter($ipaddress, 'is_numeric');
}
// ...
'ip' => empty($ipaddress) ? '' : (is_array($ipaddress) && count($ipaddress) > 0 ? json_encode(array_map('intval', $ipaddress)) : -1)

On the read path, even if legacy unvalidated strings exist in the database, the patch forces integer casting on the array elements before they are concatenated into the SQL statement, neutralizing any dynamic string elements:

// Patched query interpolation in lib/Froxlor/Api/Commands/IpsAndPorts.php
if (!empty($this->getUserDetail('ip')) && $this->getUserDetail('ip') != -1) {
    $ip_ids = array_map('intval', json_decode($this->getUserDetail('ip'), true));
    $ip_where = 'WHERE id IN (' . implode(', ', $ip_ids) . ')';
    $append_where = true;
}

Exploiting this second-order vulnerability requires a two-step administrative sequence. First, the attacker must have an administrative account with the change_serversettings privilege. The attacker targets the API endpoint Admins.add or Admins.update and supplies a maliciously crafted payload within the ipaddress array parameter.

Instead of passing standard numeric IDs, the attacker sends an array containing a nested SQL syntax breakout. For example, passing the array ["1", "1) UNION SELECT 1,2,3,4,group_concat(loginname, 0x3a, password),6,7,8,9,10 FROM panel_admins -- "] causes the JSON encoder to write the serialized string representation of this structure to the database column panel_admins.ip of the targeted user profile.

In the second stage, the attacker authenticates as the modified user or forces the execution of the listing query by invoking the IpsAndPorts.listing command. When the system executes this API action, it pulls the string from the database, decodes the array, and implodes it into the query. The database engine executes the command, processing the UNION SELECT payload, which allows the attacker to dump password hashes or bypass access controls.

The impact of this vulnerability is significant, as it grants complete access to the underlying database structure. An administrative attacker with restricted scope can elevate privileges, bypass regional controls, and extract sensitive information from all tables in the database.

The most critical threat vector is the exposure of administrative user credentials. By executing UNION statements, the attacker can extract user login names and their bcrypt-hashed passwords. Since many administrators reuse passwords across internal systems, this credential theft could lead to further compromise of the hosting infrastructure.

Furthermore, the ability to write to the database or alter system settings via SQL execution compromises the entire hosting panel environment. An attacker could register unauthorized domain records, create administrative backdoors, or tamper with customer configuration files, presenting a high threat to confidentiality, integrity, and availability.

The primary remediation for this vulnerability is upgrading Froxlor to version 2.3.8 or higher. The update implements a robust defense-in-depth security model by enforcing structural validations on both the write (input) and read (output) paths.

If patching immediately is not feasible, administrators should audit administrative accounts to ensure that only trusted personnel have the change_serversettings permission. Since the initial injection requires write access to the administrative configuration parameters, limiting this permission minimizes the available attack surface.

Additionally, administrators can execute database-level sanity checks to identify legacy malicious payloads already stored in the database. A query scanning the panel_admins.ip column for non-numeric arrays can pinpoint potential indicator files or compromised configurations before they are triggered by the application logic.