Froxlor accepts an attacker-controlled ipaddress array in the Admins.add and Admins.update API calls and stores the array as JSON without enforcing numeric element types. A poisoned account can later trigger a UNION-based payload when calling IpsAndPorts.listing or Domains commands, which decode the JSON and concatenate its elements into a SQL IN clause without parameterization. This second-order SQL injection allows an authenticated administrator with change_serversettings permission to extract arbitrary database data, including administrator login names and bcrypt password hashes, leading to privilege escalation and broader database compromise.

The vulnerability affects all Froxlor deployments running any version prior to 2.3.8. The issue was addressed and fixed in the 2.3.8 release. No other vendor or product is listed.

The CVSS score of 7.2 indicates a medium-to-high severity. EPSS information is not available and the vulnerability is not listed in CISA KEV, suggesting it is not actively exploited at this time. However, because the attack requires authenticated access with change_serversettings permission, it is likely to be exploited by an attacker who has compromised an admin account or gained legitimate administrative access. The lack of external public exploit evidence does not diminish the risk of an insider or credential-leak scenario. The vulnerability is a classic second-order SQL injection (CWE-89) that can enable data exfiltration by leveraging legitimate API operations.