CVE-2026-54348

### Summary A second-order SQL injection vulnerability in Froxlor's admin API allows an authenticated administrator to store a crafted SQL payload in the `panel_admins.ip` column via the `Admins.add` or `Admins.update` endpoint. The payload executes as a UNION-based SQL injection the next time `IpsAndPorts.listing` is called by the poisoned account, returning arbitrary data from the database — including all administrator login names and bcrypt password hashes. --- ### Details The vulnerability spans two code locations that form a store-then-trigger chain. **Stage 1 — Unsanitized array stored as JSON** — `lib/Froxlor/Api/Commands/Admins.php:251,358` ```php $ipaddress = $this->getParam('ipaddress', true, -1); // No type enforcement or content validation on $ipaddress. // PHP evaluates (is_array([...]) && non_empty_array > 0) as true, // so any attacker-controlled array is JSON-encoded and stored verbatim. 'ip' => empty($ipaddress) ? "" : (is_array($ipaddress) && $ipaddress > 0 ? json_encode($ipaddress) // ← attacker payload written to panel_admins.ip : -1), ``` The INSERT/UPDATE uses a prepared statement, so the write itself is safe. The danger is what is stored. **Stage 2 — JSON payload imploded directly into SQL** — `lib/Froxlor/Api/Commands/IpsAndPorts.php:71-77` ```php if (!empty($this->getUserDetail('ip')) && $this->getUserDetail('ip') != -1) { // json_decode restores the array; implode joins elements with no casting or escaping $ip_where = "WHERE `id` IN (" . implode(", ", json_decode($this->getUserDetail('ip'), true)) . ")"; } $result_stmt = Database::prepare( "SELECT * FROM `panel_ipsandports` " . $ip_where . ... ); // Final SQL: SELECT * FROM panel_ipsandports WHERE `id` IN (<PAYLOAD>) ``` The same unsanitized implode pattern exists in `lib/Froxlor/Api/Commands/Domains.php:1016`. Every other place in the codebase that builds dynamic `IN` clauses uses either integer casting (`(int)`) or parameterized subqueries. The `ip`-column