SQL Injection Vulnerability in Froxlor Server Administration Software

CVE-2026-54348

What is CVE-2026-54348?

Froxlor, an open-source server administration software, is affected by a SQL injection vulnerability due to inadequate type enforcement in its API endpoints. Specifically, the Admins.add and Admins.update functions allow an attacker to input a malicious IP address array that is stored in a JSON format without proper sanitization. This vulnerability is exploitable by an authenticated administrator with change_serversettings permission, enabling them to store a crafted payload. Upon subsequent access to the affected endpoints, this payload can be executed, resulting in the potential retrieval of sensitive data from the database, including administrator login information and password hashes. This flaw has been addressed in version 2.3.8.

References