Patchfirst
Patchfirst
CVE-2023-0315 Public exploit High · 7.2 EPSS 97.7%

Command Injection in froxlor/froxlor

froxlor · froxlor/froxlor

Summary

Command injection exists in the froxlor/froxlor product (the froxlor web hosting control panel) in versions prior to 2.0.8, where special elements in input are not neutralised before being used in a system command. An attacker who has high-privilege authenticated access over the network, and no user interaction, can inject commands that the affected component executes, with potential for high confidentiality, integrity and availability impact.

Official description · CVE.org

Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.

Breakdown
30.0 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (PoC-in-GitHub) appeared 13 days after disclosure. No confirmed exploitation is recorded.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+13 days

See the family tree

4 related vulnerabilities in the same code over 16 months. The latest fix listed for froxlor/froxlor is 2.0.10.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2023-0315Command Injection in froxlor/froxlor16 Jan 2023
  2. relatedMedium

    Why these are linked:

    • Same code patched: froxlor.sql.php, update_2.x.inc.php, Froxlor.php, de.lng.php, en.lng.php (machine-matched)Functions: Froxlorcommit 090cfc2commit 1679675
    CVE-2023-2666Allocation of Resources Without Limits or Throttling in…12 May 2023
  3. relatedHigh

    Why these are linked:

    • Fixed one release later2.0.16 → 2.0.20 (froxlor/froxlor)
    • Same code patched: de.lng.php, en.lng.php (machine-matched)commit 1679675commit 4642160
    CVE-2023-3173Improper Restriction of Excessive Authentication Attempts in…9 Jun 2023
  4. same family
    CVE-2024-34070Froxlor Vulnerable to Blind XSS Leading to Froxlor Application…10 May 2024

Fixes in froxlor/froxlorPackagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.0.0-beta1CVE-2022-486731 Dec 2022
  2. 2.0.0-beta1CVE-2022-486831 Dec 2022
  3. 2.0.0CVE-2023-031616 Jan 2023
  4. 2.0.8CVE-2023-031516 Jan 2023
  5. 2.0.10CVE-2023-056429 Jan 2023
  6. 2.0.10CVE-2023-056529 Jan 2023
  7. 2.0.10CVE-2023-056629 Jan 2023Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: froxlor/froxlor.

Packagistfroxlor/froxlorGHSA-cp68-42pf-6627

Upgrade to 2.0.14 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2023-2034).

Set the version to 2.0.14 or later in your composer.json.

First fixed in 2.0.8 for CVE-2023-0315.

Affected versions

If you runUpgrade to
All versions before 2.0.82.0.14first fix for this CVE: 2.0.8

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

4 links, grouped by NVD tag

Other 4

huntr.dev/bounties/ff4e177b-ba48-4913-bbfa-ab8ce0db5943github.com/froxlor/froxlor/commit/090cfc26f2722ac3036cc7fd1861955bc36f065apacketstormsecurity.com/files/171108/Froxlor-2.0.6-Remote-Command-Execution.htmlpacketstormsecurity.com/files/171729/Froxlor-2.0.3-Stable-Remote-Code-Execution.html
↑ ↓ chooseEnter openEsc close