CVE-2026-54348: Froxlor Second-Order SQL Injection Vulnerability Allows Full Database Exfiltration
Summary
CVE-2026-54348: A second-order SQL injection vulnerability in Froxlor's admin API allows an authenticated administrator to store a crafted SQL payload in the panel_admins.ip column via the Admins.add or Admins.update endpoint. Affects froxlor/froxlor versions < 2.3.8. Fixed in 2.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Froxlor is an open-source server management panel designed for web hosting providers. It allows administrators to manage multiple servers, domains, and customer accounts efficiently. The platform provides a user-friendly interface and a robust API for automation. However, it is vulnerable to a second-order SQL injection attack, which can lead to severe data breaches if exploited.
Vulnerability Detail
A second-order SQL injection vulnerability exists in Froxlor's admin API, specifically through the Admins.add and Admins.update endpoints. An authenticated administrator can store a malicious SQL payload in the panel_admins.ip column. This payload is executed as a UNION-based SQL injection when the IpsAndPorts.listing function is called, allowing attackers to retrieve sensitive data from the database, including administrator login names and bcrypt password hashes. The vulnerability arises from unsanitized data being stored and later used in SQL queries without proper validation or escaping.
How To Fix
Minimum fixed version
2.3.8
This is the first release that contains the fix.
composer require froxlor/froxlor:2.3.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, validate the input at the storage time in the Admins.add and Admins.update functions. Ensure that the ipaddress parameter is sanitized before storing it. For example:
if (is_array($ipaddress)) {
$ipaddress = array_filter($ipaddress, 'is_numeric');
}
'ip' => empty($ipaddress) ? "" : (is_array($ipaddress) && count($ipaddress) > 0
? json_encode(array_map('intval', $ipaddress))
: -1),
Conclusion
The Froxlor second-order SQL injection vulnerability (CVE-2026-54348) poses a significant risk to installations with the API enabled. It allows authenticated administrators to store malicious SQL payloads that can lead to full database exfiltration. Immediate action is required to update to the patched version or implement the suggested code fixes to mitigate the risk.
See every vulnerability recorded for froxlor/froxlor →
FAQ
A second-order SQL injection occurs when an attacker is able to inject malicious SQL code into a database through a stored input that is later executed in a different context.
Any Froxlor installation with the API enabled and at least one admin account that has the permission to change server settings is at risk.
Attackers can extract all administrator login names and bcrypt password hashes, potentially leading to unauthorized access to accounts.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 7.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for froxlor/froxlor.
