CVE-2026-41229
CriticalSummary
Froxlor to oprogramowanie do zarządzania serwerem typu open source. W wersjach przed 2.3.6, funkcja `PhpHelper::parseArrayToString()` zapisuje wartości tekstowe w pojedynczych cudzysłowach PHP bez odpowiedniego zabezpieczenia przed wstrzyknięciem. To umożliwia atakującemu wstrzyknięcie dowolnego kodu PHP, który będzie wykonywany jako użytkownik serwera WWW.
Risk Assessment
Podatność ta stwarza poważne ryzyko dla organizacji, ponieważ pozwala na zdalne wykonanie kodu PHP, co może prowadzić do przejęcia kontroli nad serwerem. Atakujący może wykorzystać tę lukę do wykonania nieautoryzowanych działań w kontekście serwera.
Recommendation
Zaleca się aktualizację oprogramowania Froxlor do wersji 2.3.6 lub nowszej, aby załatać tę podatność. Dodatkowo, warto przeprowadzić audyt uprawnień oraz monitorować logi serwera w celu wykrycia potencjalnych prób ataku.
Related vulnerabilities
- CVE-2026-95606Critical
Deserialization of untrusted data vulnerability in The Events Calendar plugin allows object injection. Affects versions up to 6.17.4.
- CVE-2026-95605Critical
SQL injection vulnerability in WP Data Access allows blind SQL injection. Affects versions up to 5.5.82.
- CVE-2026-76501Critical
Vulnerability in SRv6 OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM and SRv6 features are enabled.
- CVE-2026-76500Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper control of a resource through its lifetime (CWE-664). These have been addressed in hardening releases.
- CVE-2026-76499Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper neutralization issues (CWE-707). These have been addressed in hardening releases.
- CVE-2026-76498Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper access control (CWE-284). These have been addressed in hardening releases.
- CVE-2026-76486Critical
Vulnerability in VXLAN OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM is enabled.
- CVE-2026-76485Critical
Vulnerability in VXLAN OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM is enabled.
- CVE-2026-76483Critical
A security review in Cisco License On-Prem (formerly SSM On-Prem) revealed multiple vulnerabilities related to insufficiently protected credentials (CWE-522). These have been addressed in hardening releases.
- CVE-2026-76482Critical
A security review in Cisco License On-Prem (formerly SSM On-Prem) revealed multiple vulnerabilities related to improper input verification (CWE-347). These have been addressed in hardening releases.
Original NVD description (English source)
Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into single-quoted PHP string literals without escaping single quotes. When an admin with `change_serversettings` permission adds or updates a MySQL server via the API, the `privileged_user` parameter (which has no input validation) is written unescaped into `lib/userdata.inc.php`. Since this file is `require`d on every request via `Database::getDB()`, an attacker can inject arbitrary PHP code that executes as the web server user on every subsequent page load. Version 2.3.6 contains a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS