THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-w27m-rmmf-g5w4 (high) — Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

[GHSA] GHSA-w27m-rmmf-g5w4 (high) — Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

highgithub_advisoriesPublished 2026-08-18

GHSA-w27m-rmmf-g5w4 Severity: high CVE: CVE-2026-54348

Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

### Summary

A second-order SQL injection vulnerability in Froxlor's admin API allows an authenticated administrator to store a crafted SQL payload in the `panel_admins.ip` column via the `Admins.add` or `Admins.update` endpoint. The

MITRE ATT&CK techniques

Email AccountsT1586.002
Email AccountsT1585.002
CredentialsT1589.001

Indicators of compromise

CVE-2026-54348cve
http://TARGET/api.phpurl
http://TARGET/admin_index.php?page=ipsandportsurl
x@x.localemail

Original source: https://github.com/advisories/GHSA-w27m-rmmf-g5w4