The flaw in the DomainZones.add API parameter handling permits an authenticated customer with DNS‑zone permissions to embed newline, tab, or semicolon characters into the record or type fields. When BIND processes the resulting zone file, the injected characters create additional resource‑record lines, bypassing Froxlor’s input validation. This injection gives the attacker the ability to alter or delete DNS records within any zone the user is authorized to manage, potentially impacting data integrity, confidentiality of DNS information, and availability of services relying on those records.

The vulnerability affects all releases of the Froxlor open‑source server administration software prior to version 2.3.8. Users running Froxlor 2.3.8 or later are not affected.

The CVSS score of 5.4 indicates a moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated and possess DNS‑zone management rights, making the attack likely remote but constrained to the scope of the infected zone. If exploited, it could lead to unauthorized DNS record modifications or denial of service to domain owners. The risk is therefore moderate but non‑negligible for organizations that expose exposed DNS zone management to multiple users.