CVE-2026-54348

Executive Summary

CVE-2026-54348 is a high-severity SQL injection vulnerability in Froxlor, an open-source server administration platform, affecting all versions prior to 2.3.8. An authenticated administrator possessing the change_serversettings permission can inject a UNION-based SQL payload through the ipaddress parameter in the Admins.add and Admins.update API endpoints, which is later executed unsafely when the poisoned account accesses IpsAndPorts.listing. Successful exploitation results in full database compromise, including the exfiltration of administrator login names and bcrypt password hashes, potentially leading to privilege escalation across the entire Froxlor deployment and broader server infrastructure management capabilities. With a CVSS score of 7.2 and high impact across confidentiality, integrity, and availability, this vulnerability represents a critical risk for organizations relying on Froxlor for hosting management.

Technical Analysis

The vulnerability resides in the insecure handling of an attacker-controlled ipaddress array within Froxlor's administrative API. The flaw spans multiple components of the API architecture:

Injection Point: The Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress parameter. This parameter is expected to be an array of numeric IP addresses, but the endpoint does not validate or enforce numeric element types on the array contents. The entire array is serialized as JSON and stored in the panel_admins.ip database column without sanitization.

Trigger Point: When the affected administrator account subsequently invokes the IpsAndPorts.listing API endpoint (or the same code path in lib/Froxlor/Api/Commands/IpsAndPorts.php), the stored JSON array is decoded, and its elements are concatenated directly into a SQL IN clause. The concatenation occurs without parameterization or casting to integer types, converting the stored JSON values into raw SQL fragments that are passed directly to the database engine. The identical unsafe pattern is replicated in lib/Froxlor/Api/Commands/Domains.php for domain-related operations.

Mechanism: The vulnerability is a classic stored second-order SQL injection (CWE-89). The intended data flow is: administrator IP restrictions are stored as JSON → retrieved and used to filter available IPs/ports through a SQL IN clause. The flawed implementation allows an administrator to store SQL payload fragments within the ipaddress array elements. When the application later constructs a query such as SELECT ... FROM ... WHERE ip IN (element1, element2, ...), the stored payload becomes embedded directly into the SQL statement.

Attack Surface: The attack requires authentication as an administrator with the change_serversettings permission. The attack surface includes:

• The admin API endpoints for creating/updating administrator accounts
• The IP/port listing functionality invoked by the poisoned account
• The domain listing functionality with the same flawed pattern

Preconditions: An attacker must first compromise an administrator account or create a malicious one via an existing admin account. The stored payload persists until triggered, creating a time-delayed attack that can survive credential changes and policy updates.

Exploitation Scenarios

Based strictly on the NVD description, the following attack chain is inferred:

Step 1 — Reconnaissance/Target Identification: An attacker who has already obtained valid administrator credentials with change_serversettings permission targets a vulnerable Froxlor instance (version < 2.3.8). Shodan queries can identify exposed Froxlor panels across the internet. The attacker verifies the exact version via the panel's login page footer or API version endpoints.

Step 2 — Payload Injection: Using the authenticated session, the attacker invokes Admins.add or Admins.update — either creating a dedicated malicious account or poisoning an existing one they control. The crafted ipaddress parameter is supplied as a JSON array where one or more elements contain a UNION-based SQL injection fragment rather than a numeric IP address. For example, an element might be crafted to terminate the current query and append a UNION SELECT statement that extracts data from database tables. The payload is stored as JSON in panel_admins.ip.

Step 3 — Trigger and Execution: The attacker, using the poisoned account (or waiting until the poisoned account's IP restrictions are queried), invokes IpsAndPorts.listing. The application decodes the JSON array from the database and constructs the SQL query with the raw elements concatenated into the IN clause. The injected UNION payload executes against the database. Because the query concatenation lacks parameterization or type casting, the payload is executed with the same privileges as the application's database user.

Step 4 — Post-Exploitation Impact: The UNION-based injection allows the attacker to retrieve arbitrary database contents, specifically targeting:

• Administrator usernames and bcrypt password hashes from the administrator table
• Potentially other configuration tables, customer data, and server credentials
• The extracted bcrypt hashes can be offline-cracked to obtain plaintext passwords for privilege escalation
• With full database access, the attacker may modify database records to reset admin passwords or manipulate server configuration, potentially gaining control over managed servers

No public PoC is available for this vulnerability; the attack chain is inferred from the vulnerability description. The stored nature of the injection means the malicious payload can be planted and triggered asynchronously, potentially evading real-time detection of the initial injection.

Impact Assessment

Business Impact: Froxlor is server administration software used by hosting providers and system administrators to manage multiple web servers, mail servers, and DNS configurations. Successful exploitation grants an attacker access to:

• Administrator credentials (bcrypt hashes) for the Froxlor panel
• Potentially the ability to manage, modify, or disrupt hosted services
• Access to customer data stored in the database
• Possible lateral movement to managed servers if credentials or configuration files are extracted

Affected Systems: All Froxlor deployments running versions prior to 2.3.8 are vulnerable. The attack vector requires an authenticated administrator session, meaning the threat model involves either insider threats or attackers who have already compromised an admin account through other means (credential stuffing, phishing, password reuse, or other vulnerabilities).

Blast Radius: The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates high impact across all three CIA pillars. The privilege requirements (PR:H) moderate the severity, but the network-based attack vector (AV:N) and low attack complexity (AC:L) make exploitation straightforward for authenticated attackers. The lack of user interaction (UI:N) and scope unchanged (S:U) simplify the attack. The stored nature of the payload amplifies risk — even if the initial injection is logged, the trigger can occur from a different account and at a later time. Organizations should consider this a high-priority risk if they operate Froxlor with multi-administrator environments or have experienced any credential exposure.

Detection Guidance

The following detection rules are designed to identify both the initial payload injection and the subsequent trigger of the stored SQL injection. These rules should be deployed as part of a defense-in-depth strategy, complementing database-level query logging and file integrity monitoring.

Sigma Rule

Sigma rule detects Froxlor admin API requests containing SQL injection patterns in the ipaddress parameter.

title: Froxlor Admin API SQL Injection Attempt - CVE-2026-54348
id: 7f9a3c2d-5b81-4e6f-9a10-b2c34d5e6f70
status: experimental
description: Detects SQL injection attempts targeting Froxlor Admins.add/update endpoints via ipaddress parameter
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54348
author: valtersit.com Threat Intel
date: 2026/04/30
tags:
    - attack.initial_access
    - attack.persistence
    - attack.t1190
    - cve.2026.54348
logsource:
    category: webserver
    product: apache
    definition: 'Froxlor panel access logs with POST body capture'
detection:
    selection_path:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/lib/Froxlor/Api/Commands/Admins.php'
            - 'Admins.add'
            - 'Admins.update'
    selection_payload:
        cs-body|contains:
            - 'UNION SELECT'
            - 'union select'
            - 'UNION ALL'
            - 'information_schema'
            - 'concat('
            - '0x'
            - 'SLEEP('
            - 'BENCHMARK('
            - 'load_file('
            - 'into outfile'
            - 'extractvalue('
            - 'updatexml('
    condition: selection_path and selection_payload
falsepositives:
    - Legitimate administrator input containing SQL keywords as text
level: high

YARA Rule

YARA rule detects log entries or captured traffic containing the SQL injection pattern targeting Froxlor.

rule Detect_Froxlor_SQLi_CVE_2026_54348
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects SQL injection patterns targeting Froxlor ipaddress parameter"
        cve = "CVE-2026-54348"
        date = "2026-04-30"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54348"
    
    strings:
        $a1 = "Admins.add" ascii nocase
        $a2 = "Admins.update" ascii nocase
        $a3 = "ipaddress" ascii nocase
        $a4 = "Admins.php" ascii nocase
        
        $b1 = "UNION SELECT" ascii nocase
        $b2 = "UNION ALL" ascii nocase
        $b3 = "information_schema" ascii nocase
        $b4 = "concat(" ascii nocase
        $b5 = "load_file(" ascii nocase
        $b6 = "INTO OUTFILE" ascii nocase
        $b7 = "extractvalue(" ascii nocase
        $b8 = "updatexml(" ascii nocase
        $b9 = "SLEEP(" ascii nocase
        $b10 = "BENCHMARK(" ascii nocase
        $b11 = "0x" ascii fullword
        $b12 = "SELECT" ascii nocase
    
    condition:
        uint16(0) == 0x0D0A or filesize > 0
        and (1 of ($a*) and 1 of ($b*))
        and (2 of ($b*))
}

Suricata IDS Rule

Suricata rule detects network-level SQL injection attempts against Froxlor admin API endpoints.

alert http any any -> $HOME_NET any (msg:"Froxlor Admin API SQL Injection - CVE-2026-54348"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"Admins.php"; http.uri; content:"Admins.add"; http.uri; content:"Admins.update"; http.client_body; pcre:"/(UNION\+SELECT|UNION\+ALL|information_schema|concat\(|load_file\(|into\+outfile|extractvalue\(|updatexml\(|SLEEP\(|BENCHMARK\(|0x[0-9a-fA-F]{4,})/i"; classtype:attempted-admin; reference:cve,2026-54348; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-54348; sid:202654348; rev:1; priority:1;)

Elastic Detection

Elastic EQL rule to detect SQL injection patterns in Froxlor web logs.

sequence by source.ip
  [network where event.category == "web" and
   network.protocol == "http" and
   http.request.method == "POST" and
   url.path like "*Admins.php*" and
   (url.query like "*Admins.add*" or url.query like "*Admins.update*")
  ]
  [network where event.category == "web" and
   http.request.body.content like "*ipaddress*" and
   (http.request.body.content like "*UNION SELECT*" or
    http.request.body.content like "*UNION ALL*" or
    http.request.body.content like "*information_schema*" or
    http.request.body.content like "*concat(*" or
    http.request.body.content like "*load_file(*" or
    http.request.body.content like "*into outfile*" or
    http.request.body.content like "*extractvalue(*" or
    http.request.body.content like "*updatexml(*" or
    http.request.body.content like "*SLEEP(*" or
    http.request.body.content like "*BENCHMARK(*")
  ]

Splunk SPL Query

Splunk search to identify Froxlor SQL injection exploitation attempts.

index=web sourcetype=access_combined 
  [search index=web sourcetype=access_combined 
    (uri="*/lib/Froxlor/Api/Commands/Admins.php*") 
    OR (uri="*Admins.add*") OR (uri="*Admins.update*")
    method=POST
  ]
| rex field=_raw "ipaddress[\"']?\s*[:=]\s*[\"']?(?<iparray>[^&,]+)"
| eval sqli_flags = case(
    match(lower(_raw), "union[\s]+select"), "union_select",
    match(lower(_raw), "union[\s]+all"), "union_all",
    match(lower(_raw), "information_schema"), "information_schema",
    match(lower(_raw), "concat\("), "concat",
    match(lower(_raw), "load_file"), "load_file",
    match(lower(_raw), "into[\s]+outfile"), "into_outfile",
    match(lower(_raw), "extractvalue\("), "extractvalue",
    match(lower(_raw), "updatexml\("), "updatexml",
    match(lower(_raw), "sleep\("), "sleep",
    match(lower(_raw), "benchmark\("), "benchmark",
    1=1, "none"
  )
| search sqli_flags != "none"
| stats count by clientip, uri, sqli_flags, _time
| sort - _time
| table _time, clientip, uri, sqli_flags, count
| rename clientip AS "Source IP", uri AS "Request URI", sqli_flags AS "SQLi Pattern"

Wazuh OSSEC Rule

Wazuh XML rule detecting Froxlor SQL injection in Apache access logs.

<group name="web, sql_injection, froxlor,">
  <rule id="411837" level="12">
    <if_sid>31100, 31101, 31103</if_sid>
    <match>Admins.php|Admins.add|Admins.update</match>
    <regex>POST \S+Admins\.php</regex>
    <description>Froxlor Admin API accessed with POST method - possible SQL injection (CVE-2026-54348)</description>
    <group>attack.sql_injection,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
  
  <rule id="411838" level="15">
    <if_sid>2026543</if_sid>
    <regex>UNION\s+SELECT|UNION\s+ALL|information_schema|concat\(|load_file\(|INTO\s+OUTFILE|extractvalue\(|updatexml\(|SLEEP\(|BENCHMARK\(</regex>
    <description>SQL injection payload detected in Froxlor Admin API request - CVE-2026-54348 exploitation attempt</description>
    <group>attack.sql_injection,attack.reconnaissance,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor fix is confirmed in version 2.3.8, which addresses the vulnerable code paths in Admins.php, IpsAndPorts.php, and Domains.php.

1. Immediate Mitigations (until patched):

• Immediately upgrade Froxlor to version 2.3.8 or later, which contains the fix for this vulnerability
• If immediate upgrade is not possible, restrict access to the Froxlor admin panel to trusted networks/IP addresses via firewall rules
• Enforce multi-factor authentication (MFA) on all administrator accounts to reduce the risk of credential compromise leading to exploitation
• Audit all existing administrator accounts, particularly any with change_serversettings permission, and review stored ipaddress values in panel_admins.ip for anomalous SQL patterns
• Restrict Admins.add and Admins.update API access to only essential administrative users

2. Patch/Upgrade Steps:

• Backup the Froxlor database and configuration files
• Review Froxlor release notes for version 2.3.8 to confirm upgrade compatibility
• Apply the upgrade through the Froxlor update mechanism or manual package replacement
• After upgrade, verify the fix by attempting to store non-numeric values in the ipaddress parameter
• Test core workflows including IP/port listing and domain management to confirm no regression

3. Long-Term Hardening:

• Implement principle of least privilege: review which administrators truly require change_serversettings permission
• Deploy a WAF (Web Application Firewall) in front of the Froxlor panel with SQL injection detection rules
• Enable comprehensive database query logging to detect anomalous SQL patterns post-exploitation
• Implement database-level protections including limited application database user privileges (avoid FILE and SUPER privileges)
• Consider running Froxlor in a containerized or isolated environment to reduce blast radius
• Regularly audit administrator account creation and modification through API logs
• Subscribe to Froxlor security advisories for future vulnerability notifications
• If exposed to the internet, consider placing the admin panel behind a VPN or bastion host

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-54348
2. Froxlor Official Site: https://froxlor.org/ — source of version 2.3.8 fix and release notes
3. Froxlor GitHub Repository: https://github.com/Froxlor/Froxlor — for patch commit history and code review
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application technique reference
5. CWE-89 SQL Injection: https://cwe.mitre.org/data/definitions/89.html — vulnerability class reference

Threat Actor Campaigns: No known threat actor campaigns or exploitation in the wild have been reported for this CVE at the time of writing. The CVE has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The lack of public PoC and exploit code suggests limited current exploitation pressure, but organizations should not delay patching given the high CVSS score and the relative maturity of UNION-based SQL injection techniques. Monitor NVD and Froxlor advisories for updates regarding active exploitation.