CVE-2020-28957

An attacker with a low-privilege user account (reseller or customer) sends a POST request to the customer add module with malicious script code embedded in the `name`, `firstname`, or `username` parameters [ref_id=1]. The payload is stored server-side and later rendered unsanitized in the admin backend pages `admin_customers.php` and `customers.php`, where it executes in the browser of an administrator viewing the customer list or traffic module [ref_id=1]. This is a persistent (stored) XSS attack [CWE-79] that requires no user interaction beyond the admin viewing the affected page.

The vulnerability resides in the Customer Add module of Froxlor v0.10.16. The `username`, `name`, and `firstname` input fields in the customer add/registration form are not sanitized before being stored and later rendered in `admin_customers.php` and `customers.php` [ref_id=1]. The injection point is the registration or customer add/edit module, and the payload executes when an admin views the traffic module in the admin backend [ref_id=1].

The advisory recommends three remediation steps: validate and escape the content of the vulnerable `username`, `name`, and `firstname` input fields; restrict the input fields to disallow special characters; and encode the output at the two execution points (`admin_customers.php` and `customers.php`) [ref_id=1]. No patch diff is included in the bundle, but the vendor was notified and a fix was reportedly developed by 2020-10-12 [ref_id=1]. The fix closes the vulnerability by ensuring user-supplied data is neutralized before being stored and before being rendered in the admin interface.

1. Register or log in with a low-privilege user account on the Froxlor panel [ref_id=1]. 2. Open the profile account section or the customer add form. 3. Inject a test payload (e.g., `test%20>"div style=1`) into the `name`, `firstname`, or `username` input fields [ref_id=1]. 4. Save or submit the form via POST. 5. Wait until an admin or higher-privileged user opens the traffic stats page (`admin_traffic.php`), where the payload executes in the browser [ref_id=1].