The flaw is a PHP code injection caused by the system’s failure to escape single quotes when converting array data to a string. An administrator with the change_serversettings privilege can add or modify a MySQL server via the API and supply a privileged_user value that is written directly into a PHP file. Because that file is loaded on every web request, the injected code runs as the web server user on each subsequent page load, giving full control over the system. The weakness is identified as CWE‑94.

Froxlor, all releases earlier than 2.3.6 are affected. The vulnerability exists in every installation built before the 2.3.6 patch, regardless of deployment environment.

The CVSS score of 9.1 reflects a high severity Remote Code Execution scenario. The EPSS score of less than 1% suggests that real‑world exploitation is unlikely, and the vulnerability has not been catalogued by CISA as a known exploited vulnerability. Exploitation requires an attacker to be able to execute the Froxlor API as a user with change_serversettings permission; once that privilege is obtained, the attacker can inject PHP code that runs with every page request, offering complete compromise of the server. Given the wide reach of the injected code, the impact is system‑wide, affecting confidentiality, integrity, and availability.