Skip to content
Threat Feed
Subscribe

Tag

Php-Injection

1 brief RSS
critical advisory

Froxlor PHP Code Injection via Unescaped Single Quotes in userdata.inc.php

Froxlor is vulnerable to PHP code injection due to unescaped single quotes in the userdata.inc.php generation via the MysqlServer API, where an administrator with `change_serversettings` permission can inject arbitrary PHP code, leading to arbitrary OS command execution as the web server user.

Froxlor php-injection webserver
2r 2t