Admin-level data exfiltration via stored SQL injection

SQL injection in Froxlor before 2.3.8 allows remote authenticated users to read database data via a stored ipaddress payload. Admins.add and Admins.update store attacker-controlled ipaddress arrays in panel_admins.ip as JSON, and IpsAndPorts.listing and Domains.php later decode and implode those values into SQL IN clauses without integer casting or parameterization. Reachability requires an administrator account with change_serversettings permission and a later call by the poisoned account, after which UNION-based queries can expose administrator login names, bcrypt password hashes, and other database rows.