Froxlor has an HTML Injection Vulnerability
Date: 2025-03
Affected: composer/froxlor/froxlor
Attack vector: phishing
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-48958
CWE: CWE-79
CWE-80
CVSS: 5.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)

### Summary _An HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has a medium severity, as it can be exploited through user input without authentication._ ### Observation _It is observed that in the portal of the customer account, there is a functionality in the email section to create an email address that accepts user input. By intercepting the request and modifying the "domain" field with an HTML injection payload containing an anchor tag, the injected payload is reflected on an error page. When clicked, it redirects users to an external website, confirming the presence of an HTML Injection vulnerability._ ### PoC 1. Navigate to the Email section in the Customer Account Portal and create a new email address. 2. Enter any garbage value in the required field and intercept the request using Burp Suite. 3. Locate the "domain" field in the intercepted request and replace its value with the following HTML Injection payload: `<a href="&#x68;&#x74;&#x74;&#x70;&#x73;&#x3a;&#x2f;&#x2f;&#x77;&#x77;&#x77;&#x2e;&#x67;&#x6f;&#x6f;&#x67;&#x6c;&#x65;&#x2e;&#x63;&#x6f;&#x6d;">CLiCK</a>` 4. Forward the modified request and observe that the injected payload is reflected on an error page. 5. Click on the displayed "CLiCK" link to verify that it redirects


Mitigations:

Architectural layers (MAESTRO):