PT-2018-9424 · Froxlor Team · Froxlor

Prodigysml · Published 2018-06-26 · Updated 2022-05-13 · CVE-2018-1000527

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 0.9.39.5

Description The issue concerns a PHP Object Injection vulnerability in the Domain name form, potentially leading to information disclosure and remote code execution. This can be exploited by passing malicious PHP objects in the $ POST['ssl ipandport'] variable.

Recommendations For versions prior to 0.9.39.5, update to a version that includes the fix committed after c1e62e6 to resolve the issue. As a temporary workaround, consider restricting access to the Domain name form to minimize the risk of exploitation. Avoid using the $ POST['ssl ipandport'] variable in the affected form until the issue is resolved.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2018-1000527

GHSA-G77V-M226-3F7G

Affected Products

Froxlor

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000527 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000527 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g77v-m226-3f7g · Vendor Advisory
• https://github.com/Froxlor/Froxlor/issues/555 · Note
• https://github.com/Froxlor/Froxlor/commit/c1e62e6be719affc003774a639de5c952ffd8ffc · Note
• https://github.com/Froxlor/Froxlor · Note
• https://0dd.zone/2018/05/31/Froxlor-Object-Injection · Note