Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-42325

CVE-2021-42325: Froxlor SQL injection vulnerability

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-42325
GHSA ID
GHSA-6fvw-x6gw-4wv8
EPSS Score
0.89109%
CWE
CWE-89
Published
5/24/2022
Updated
4/25/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
froxlor/froxlorcomposer<= 0.10.29.10.10.30

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the createDatabase method constructing SQL queries through string concatenation with user-supplied database names. The original code used Database::query("CREATE DATABASE " . $dbname . "") which allows SQL injection. The patch replaced this with prepared statements using :dbname parameter binding. The exploit demonstrates this vulnerability by injecting SQL through the custom_suffix parameter when creating databases. The combination of direct user input interpolation in SQL, CWE-89 classification, and the explicit patch moving to prepared statements confirms this function as the vulnerable entry point.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*roxlor t*rou** *.**.**.* *llows SQL inj**tion in `**t***s*/M*n***r/**M*n***rMySQL.p*p` vi* * *ustom ** n*m*.

Reasoning

T** vuln*r**ility st*ms *rom t** *r**t***t***s* m*t*o* *onstru*tin* SQL qu*ri*s t*rou** strin* *on**t*n*tion wit* us*r-suppli** **t***s* n*m*s. T** ori*in*l *o** us** `**t***s*::qu*ry("*R**T* **T***S* `" . $**n*m* . "`")` w*i** *llows SQL inj**tion.