CVE-2025-10327
📋 TL;DR
This CVE describes a remote command injection vulnerability in MiczFlor RPi-Jukebox-RFID versions up to 2.8.0. Attackers can execute arbitrary operating system commands by manipulating the 'playlist' parameter in the /htdocs/api/playlist/shuffle.php endpoint. Anyone running vulnerable versions of this software is affected.
💻 Affected Systems
- MiczFlor RPi-Jukebox-RFID
📦 What is this software?
Rpi Jukebox Rfid by Sourcefabric
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands with the web server's privileges, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Remote code execution allowing attackers to manipulate the jukebox system, access local files, or use the system as a foothold for further network attacks.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are implemented, though the vulnerability still allows command execution.
🎯 Exploit Status
Public exploit code is available on Exploit-DB and GitHub, making this easily weaponizable by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider upgrading to any version above 2.8.0 if available, or implement workarounds.
🔧 Temporary Workarounds
Disable vulnerable endpoint
allRemove or restrict access to the /htdocs/api/playlist/shuffle.php file
sudo rm /path/to/htdocs/api/playlist/shuffle.php
sudo chmod 000 /path/to/htdocs/api/playlist/shuffle.php
Implement input validation
allAdd proper input sanitization to the playlist parameter in shuffle.php
Edit shuffle.php to validate playlist parameter using whitelisting or proper escaping
🧯 If You Can't Patch
- Implement strict network access controls to limit who can access the jukebox web interface
- Run the software in a container or VM with minimal privileges and network access
🔍 How to Verify
Check if Vulnerable:
Check if /htdocs/api/playlist/shuffle.php exists and if version is 2.8.0 or lowerCheck Version:
Check version.txt or README files in the installation directoryVerify Fix Applied:
Verify shuffle.php is removed/restricted or test with known exploit payloads📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /api/playlist/shuffle.php
- Web server logs showing command injection patterns in playlist parameter
- System logs showing unexpected command execution
Network Indicators:
- HTTP requests containing shell metacharacters in playlist parameter
- Outbound connections from the jukebox system to unexpected destinations
SIEM Query:
web.url:*shuffle.php AND (web.param.playlist:*;* OR web.param.playlist:*|* OR web.param.playlist:*`*)