Description
Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with `change_serversettings` permission adds or updates a MySQL server via the API, the `privileged_user` parameter (which has no input validation) is written unescaped into `lib/userdata.inc.php`. Since this file is `require`d on every request via `Database::getDB()`, an attacker can inject arbitrary PHP code that executes as the web server user on every subsequent page load. Version 2.3.6 contains a patch.
Affected products
froxlor: froxlor
References4
- github.com/froxlor/froxlor/security/advisories/GHSA-gc9w-cc93-r… ExploitMitigationVendor Advisory
- github.com/froxlor/froxlor/security/advisories/GHSA-gc9w-cc93-r… ExploitMitigationVendor Advisory
- github.com/froxlor/froxlor/commit/3589ddf93ab59eb2a8971f0f56cbf… Patch
- github.com/froxlor/froxlor/releases/tag/2.3.6 Release Notes
Metrics
- CVSS 3.1
-
9.1
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 42 · as of 13 November 2026
- CWE
- CWE-94
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.