PT-2025-11215 · Froxlor · Froxlor

Halas98

·

Published

2025-03-11

·

Updated

2025-04-03

·

CVE-2025-29773

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.2.6
Description Froxlor is open-source server administration software. A vulnerability allows users, such as resellers or customers, to create accounts with the same email address as an existing account, creating potential issues with account identification and security. This vulnerability can be exploited by authenticated users who can create accounts with the same email address that has already been used by another account, such as the admin. The attack vector is email-based, as the system does not prevent multiple accounts from registering the same email address, leading to possible conflicts and security issues.
Recommendations For versions prior to 2.2.6, update to version 2.2.6 to fix the issue. As a temporary workaround, consider restricting account creation to prevent users from registering with an email address already in use by another account.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-29773
GHSA-7J6W-P859-464F

Affected Products

Froxlor