CVE-2018-1000527 Froxlor PHP Object Injection vulnerability

What is CVE-2018-1000527?

CVE-2018-1000527 is a high-severity unsafe deserialization vulnerability in n/a, published on 26 Jun 2018. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $_POST['ssl_ipandport']. This vulnerability appears to have been fixed in after commit c1e62e6.

Weakness: CWE-502

Which versions are affected by CVE-2018-1000527?

2 open source packages ship an affected version, including froxlor/froxlor. It affects 1 product.

Products include Froxlor Froxlor.

How do I fix CVE-2018-1000527?

Upgrade froxlor/froxlor to 0.9.40 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2018-1000527 being exploited?

There is no known exploitation of CVE-2018-1000527 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-41228 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution Critical 10.0
• CVE-2023-6069 Improper Link Resolution Before File Access in froxlor/froxlor Critical 9.9
• CVE-2023-0671 Code Injection in froxlor/froxlor Critical 9.9
• CVE-2023-3173 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor Critical 9.8
• CVE-2023-1307 Authentication Bypass by Primary Weakness in froxlor/froxlor Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g77v-m226-3f7g.