{"id":"CVE-2022-3721","published":"2022-11-04T00:00:00Z","modified":"2025-05-02T18:44:34Z","title":"Code Injection in froxlor/froxlor","vendor":"froxlor","product":"froxlor/froxlor","tier":"tail","description":{"text":"Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.6,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00865,"percentile":0.58626,"provenance":"source"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://huntr.dev/bounties/a3c506f0-5f8a-4eaa-b8cc-46fb9e35cf7a","tags":[]},{"url":"https://github.com/froxlor/froxlor/commit/1182453c18a83309a3470b2775c148ede740806c","tags":[]},{"url":"https://huntr.com/bounties/a3c506f0-5f8a-4eaa-b8cc-46fb9e35cf7a","tags":["exploit"]}],"priority":{"score":22.0,"factors":[{"name":"EPSS percentile","points":11.73},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":5.32}]},"vendorSlug":"froxlor","affectedVersions":[{"vendor":"froxlor","product":"froxlor/froxlor","versions":[">= unspecified, < 0.10.39"]}],"affected":[{"ecosystem":"Packagist","package":"froxlor/froxlor","vulnerableRanges":["<0.10.39"],"patched":["0.10.39"],"from":["GHSA-h95w-p3x6-wwj6"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7359","exploited":false,"provenance":"source"},"exploitRefs":["https://huntr.com/bounties/a3c506f0-5f8a-4eaa-b8cc-46fb9e35cf7a"],"lineage":{"familyId":"fam-froxlor-froxlor-cve-2022-3017","children":[{"from":"CVE-2022-3721","to":"CVE-2023-4304","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/Froxlor/Api/Commands/Admins.php"],"commits":["https://github.com/froxlor/froxlor/commit/1182453c18a83309a3470b2775c148ede740806c","https://github.com/froxlor/froxlor/commit/ce9a5f97a3edb30c7d33878765d3c014a6583597"],"basis":"shared function","functions":["update"]}]},{"from":"CVE-2022-3721","to":"CVE-2023-50256","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/Froxlor/Api/Commands/Customers.php"],"commits":["https://github.com/froxlor/froxlor/commit/1182453c18a83309a3470b2775c148ede740806c","https://github.com/Froxlor/Froxlor/commit/4b1846883d4828962add91bd844596d89a9c7cac"],"basis":"shared function","functions":["update"]}]},{"from":"CVE-2022-3721","to":"CVE-2025-29773","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/Froxlor/Api/Commands/Admins.php","lib/Froxlor/Api/Commands/Customers.php"],"commits":["https://github.com/froxlor/froxlor/commit/1182453c18a83309a3470b2775c148ede740806c","https://github.com/froxlor/Froxlor/commit/a43d53d54034805e3e404702a01312fa0c40b623"],"basis":"shared function","functions":["add","update"]}]}],"packageHistory":[{"cve":"CVE-2021-42325","published":"2021-10-12","fixed":"0.10.30","kev":false},{"cve":"CVE-2022-3017","published":"2022-08-28","fixed":"0.10.38","kev":false},{"cve":"CVE-2022-3869","published":"2022-11-05","fixed":"0.10.38.2","kev":false,"link":{"from":"CVE-2022-3869","to":"CVE-2022-3721","relation":"successor","confidence":"high","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:froxlor/froxlor","fromFixed":"0.10.38.2","toFixed":"0.10.39","daysApart":-1},{"kind":"same-code","provenance":"machine","files":["index.php"],"commits":["https://github.com/froxlor/froxlor/commit/1182453c18a83309a3470b2775c148ede740806c","https://github.com/froxlor/froxlor/commit/3f10a4adede9df83408d60ded78b51b812a763a8"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2022-3721","published":"2022-11-04","fixed":"0.10.39","kev":false},{"cve":"CVE-2022-4864","published":"2022-12-30","fixed":"2.0.0-beta1","kev":false},{"cve":"CVE-2022-4867","published":"2022-12-31","fixed":"2.0.0-beta1","kev":false},{"cve":"CVE-2022-4868","published":"2022-12-31","fixed":"2.0.0-beta1","kev":false}],"package":"Packagist:froxlor/froxlor"}}