GitHub Advisoryadvisory · Packagist

GHSA-p29c-jpgj-v57r Froxlor arbitrary code execution via the database configuration options

HIGH Published 2022-05-24 Modified 2024-04-25 Official page ↗
Aliases
CVE-2020-10235
Ecosystem
Packagist
Packages
froxlor/froxlor
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-78
Reviewed
2024-04-25

Affected packages

• Packagist froxlor/froxlor: < 0.10.14 → fixed in 0.10.14

Description

An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.

Related

Alias · CVE (1)

  • CVE-2020-10235 An issue was discovered in Froxlor before 0.10.14. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References