CyberRota Analysis
AI-GeneratedFroxlor versions prior to 2.3.7 are vulnerable due to inadequate validation of the mysql_server parameter in the Mysqls.add API command, allowing attackers to bypass access controls. This flaw enables unauthorized creation of MySQL databases and users on restricted servers, potentially leading to data breaches or service disruptions. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls.