CVE-2021-42325 Froxlor SQL injection vulnerability
An attacker can execute arbitrary SQL commands via a custom database name in Froxlor, potentially reading or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-42325?
CVE-2021-42325 is a critical SQL injection vulnerability in n/a, published on 12 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.
Weakness: CWE-89
Which versions are affected by CVE-2021-42325?
2 open source packages ship an affected version, including froxlor/froxlor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
froxlor/froxlor Packagist | All versions | 0.10.30 |
froxlor/froxlor Packagist | All versions | 0.10.30 |
Products include Froxlor Froxlor.
How do I fix CVE-2021-42325?
Upgrade froxlor/froxlor to 0.10.30 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2021-42325 being exploited?
There is no known exploitation of CVE-2021-42325 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2026-41228 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution
- CVE-2023-6069 Improper Link Resolution Before File Access in froxlor/froxlor
- CVE-2023-0671 Code Injection in froxlor/froxlor
- CVE-2023-3173 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor
- CVE-2023-1307 Authentication Bypass by Primary Weakness in froxlor/froxlor
Sources
Also known as GHSA-6fvw-x6gw-4wv8.