Froxlor CVE-2026-54348

Exploitation requires a valid Froxlor admin API key for an account with the change_serversettings=1 privilege, which is the standard permission granted to reseller or sub-admin accounts in multi-tenant hosting deployments. The Froxlor API must be enabled and reachable by the attacker. Stage 1 (poisoning) requires the ability to call Admins.add or Admins.update with an arbitrary ipaddress array parameter - no other special configuration is needed beyond that privilege flag. Stage 2 (trigger) requires authenticating as the poisoned account and calling IpsAndPorts.listing, which is automatically invoked when the account visits the IPs and Ports section of the admin panel; no victim interaction is required. Exploitation is bounded by the PR:H requirement: unauthenticated attackers and low-privilege customer accounts cannot exploit this vulnerability directly. The attack is most impactful in multi-admin deployments (hosting providers with reseller hierarchies) where a compromised or malicious sub-admin can escalate to super-admin credentials; it offers no practical gain in single-admin installations where the attacker would only exfiltrate their own credentials.

The CVSS 7.2 score (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately reflects the network-accessible attack vector and the mitigating high-privilege prerequisite, but the practical threat profile is context-dependent: in single-admin deployments self-exploitation yields no meaningful attacker gain, while in multi-admin hosting environments - exactly the deployment model Froxlor is built for - a malicious or compromised reseller admin can escalate to super-admin credentials with two API calls, and even a mid-sized hosting operation in sopot running multiple reseller accounts should treat this as urgent given the publicly confirmed working PoC. EPSS data was not provided in the input and cannot be independently quantified here. No CISA KEV listing is present, so active exploitation is unconfirmed, but the presence of a working, step-by-step PoC with confirmed live output significantly narrows the gap between theoretical and exploitable. SSVC signals are materially elevated: exploitation is PoC-public, the two-step chain is automatable, and technical impact is total on the confidentiality dimension. The overall risk posture is high for any Froxlor deployment operating with multiple admin accounts; low for single-admin self-hosters where the threat model does not apply.

An attacker holding a Froxlor reseller admin API key with change_serversettings=1 - whether legitimately provisioned or obtained via credential theft - issues a single Admins.add request with a crafted ipaddress array containing a UNION SELECT statement targeting the panel_admins table; this payload is safely stored via prepared statement but persists as malicious JSON in the ip column. The attacker then authenticates as the newly created poisoned account and calls IpsAndPorts.listing (or simply loads the IPs and Ports panel page), causing the stored payload to execute as a UNION-based SQL injection and returning every administrator's login name and bcrypt password hash in the API response. A confirmed working proof-of-concept demonstrating this exact two-step chain against a live instance has been publicly disclosed as part of the GitHub security advisory.