Froxlor Log Path RCE

Froxlor v2.0.7 and below suffer from a bug that allows authenticated users to change the application logs path to any directory on the OS level which the user www-data can write without restrictions from the backend which leads to writing a malicious Twig template that the application will render...

CVE-2023-0564

CVE-2023-0564 affects froxlor/froxlor prior to version 2.0.10. The connected documents describe a weakness in password requirements, i.e., weak passwords, as the underlying issue. There is no explicit exploit detail provided in the documents, and no product-specific exploit data is cited. The mos...

CVE-2023-0564 Weak Password Requirements in froxlor/froxlor

Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10...

CVE-2023-0566 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in froxlor/froxlor prior to 2.0.10...

CVE-2023-0572 Unchecked Error Condition in froxlor/froxlor

Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10...

Privilege Escalation from customer to root

Privilege Escalation from Customer to Root First of all, sorry for the formatting of the report, but this platform is a mess. I can't attach any PoC files added chapters at the end of the report instead, can't attach any screenshots, nor provide a report as PDF. And btw markdown is only partly...

Path Traversal

froxlor/froxlor is vulnerable to Path Traversal. A remote attacker is able to use path traversal to leak local files such as /etc/passwd or config, because there is no filename validation for logoimagelogin and logoimageheader on import and export functions...

Command Injection

froxlor/froxlor is vulnerable to Command Injection. The vulnerability is due to an Arbitrary File Write in the logging module which allows an attacker to overwrite an arbitrary file, and Template Injection. A remote authenticated attacker can chain these vulnerabilities together, resulting in...

Froxlor vulnerable to Command Injection

Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8...

Froxlor is vulnerable to path traversal

Path Traversal: '..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0...

GHSA-XP3G-2729-RXM3 Froxlor is vulnerable to path traversal

Path Traversal: '..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0...

GHSA-CP68-42PF-6627 Froxlor vulnerable to Command Injection

Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8...

CVE-2023-0316

Path Traversal: '..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0...

CVE-2023-0315

Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8...

Path traversal

Path Traversal: '..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0...

Command injection

Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8...

Froxlor 安全漏洞

Froxlor is a lightweight server management software from the Froxlor team. A security vulnerability exists in Froxlor versions prior to 2.0.0 that stems from the presence of a path traversal...

PT-2023-16171 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: froxlor versions prior to 2.0.0 Description: The issue is related to Path Traversal, where the sequence '..filename' can be used to access files outside the intended directory. This affects the GitHub repository froxlor/froxlor...

CVE-2023-0315 Command Injection in froxlor/froxlor

Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8...

Froxlor 命令注入漏洞

Froxlor is a lightweight server management software from the Froxlor team. A command injection vulnerability exists in Froxlor versions prior to 2.0.8, which stems from the presence of command injection...