GHSA-625g-fm5w-w7w4

    Dashboard / Vulnerabilities / GHSA-625g-fm5w-w7w4

    GHSA-625g-fm5w-w7w4

    Published: 4 Jan 2024Last Modified: 10 Sept 2026

    Summary: Froxlor username/surname AND company field Bypass

    Details: Dear Sirs and Madams, I would like to report a business logic error vulnerability that I discovered during my recent penetration test on Froxlor. Specifically, I identified an issue where it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements established by the system. The surname, family name AND company name all of them can be left blank. I believe addressing this vulnerability is crucial to ensure the security and integrity of the Froxlor platform. Thank you for your attention to this matter. This action served as a means to bypass the mandatory field requirements. Lets see (please have a look at the Video -> attachment). ---------------- as you can see i was able to let the username and second name blank. https://user-images.githubusercontent.com/80028768/289675319-81ae8ebe-1308-4ee3-bedb-43cdc40da474.mp4 Lets see again. Only the company name is set. Thank you for your time ![Froxlor 2](https://user-images.githubusercontent.com/80028768/289685700-73936e19-befa-4442-a258-7814f2ec4598.png) ![Froxlor 1](https://user-images.githubusercontent.com/80028768/289685710-a5785f49-d2b2-40d4-bf8f-a286df48dd36.png)

    References: https://github.com/Froxlor/Froxlor/security/advisories/GHSA-625g-fm5w-w7w4, https://nvd.nist.gov/vuln/detail/CVE-2023-50256, https://github.com/Froxlor/Froxlor/commit/4b1846883d4828962add91bd844596d89a9c7cac, https://github.com/Froxlor/Froxlor, https://user-images.githubusercontent.com/80028768/289675319-81ae8ebe-1308-4ee3-bedb-43cdc40da474.mp4

    Affected packages

    Package

    Name: froxlor/froxlor

    Purl: pkg:composer/froxlor/froxlor

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.1.2

    Affected versions

    0.10.0
    0.10.0-rc1
    0.10.0-rc2
    0.10.1
    0.10.10
    0.10.11
    0.10.12
    0.10.13
    0.10.14
    0.10.15
    0.10.16
    0.10.17
    0.10.18
    0.10.19
    0.10.2
    0.10.20
    0.10.21
    0.10.22
    0.10.23
    0.10.23.1
    0.10.24
    0.10.25
    0.10.26
    0.10.27
    0.10.28
    0.10.29
    0.10.29.1
    0.10.3
    0.10.30
    0.10.31
    0.10.32
    0.10.33
    0.10.34
    0.10.34.1
    0.10.35
    0.10.35.1
    0.10.36
    0.10.37
    0.10.38
    0.10.38.1
    0.10.38.2
    0.10.38.3
    0.10.4
    0.10.5
    0.10.6
    0.10.7
    0.10.8
    0.10.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-625g-fm5w-w7w4 | CVE-DB