GHSA-g77v-m226-3f7g

ghsaUSosv

Froxlor PHP Object Injection vulnerability

view advisory published 2022-05-13Licence: CC-BY-4.0

Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $_POST['ssl_ipandport']. This vulnerability appears to have been fixed in after commit c1e62e6.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-1000527US	high7.2	2.63% (85th)	—	2018-06-26
Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This att…

references

External citations — patches, advisories, analysis.

https://0dd.zone/2018/05/31/Froxlor-Object-InjectionWEB
https://github.com/Froxlor/FroxlorPACKAGE
https://github.com/Froxlor/Froxlor/commit/c1e62e6be719affc003774a639de5c952ffd8ffcWEB
https://github.com/Froxlor/Froxlor/issues/555WEB
https://nvd.nist.gov/vuln/detail/CVE-2018-1000527ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan