PT-2025-20378 · Miczflor+2 · Rpi-Jukebox-Rfid
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
MiczFlor RPi-Jukebox-RFID versions up to 2.8.0
Description:
A security vulnerability exists in MiczFlor RPi-Jukebox-RFID. The vulnerability is due to os command injection in the
/htdocs/api/playlist/playsinglefile.php file when manipulating the File argument. This allows for remote attacks. The vulnerability has been publicly disclosed.Recommendations:
Versions prior to 2.8.1 are affected.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Consider restricting access to the
/htdocs/api/playlist/playsinglefile.php file as a temporary workaround.
Avoid using the File parameter in the affected API endpoint until the issue is resolved.Exploit
OS Command Injection
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Rpi-Jukebox-Rfid