Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| froxlor/froxlor | composer | <= 2.3.7 | 2.3.8 |
Miggo AIRoot Cause AnalysisThe vulnerability description clearly points to lib/Froxlor/UI/Callbacks/Text.php and specifically the Text::wordwrap function as the source of the vulnerability. The commit a1d8f425b11ef7597949018814afa056a842cba0 confirms this by showing a direct modification to this function. The change involves adding htmlspecialchars() to the $attributes['data'] before it is returned by wordwrap. This indicates that prior to the patch, the function was returning unescaped user-controlled input, which, when combined with the 'raw' filter in the Twig template, led to a Stored XSS. An authenticated customer could store malicious JavaScript in a DNS TXT record, and when an administrator viewed the DNS configuration, the payload would execute in their browser. Therefore, the Froxlor\UI\Callbacks\Text.wordwrap function is the precise vulnerable function that lacked the necessary output encoding.
