CVE-2026-27504
📋 TL;DR
SVXportal versions 2.5 and earlier contain a reflected cross-site scripting vulnerability in the radiomobile_front.php file via the stationid parameter. This allows attackers to inject malicious scripts that execute in authenticated administrators' browsers when they view crafted URLs. The vulnerability affects administrators who use vulnerable SVXportal installations.
💻 Affected Systems
- SVXportal
📦 What is this software?
Svxportal by Radioinorr
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of administrator accounts leading to full system takeover, data theft, or deployment of backdoors.
Likely Case
Session hijacking allowing unauthorized administrative actions, configuration changes, or privilege escalation.
If Mitigated
Limited impact with proper input validation and output encoding preventing script execution.
🎯 Exploit Status
Exploitation requires administrator to click malicious link; proof-of-concept available in public references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Implement workarounds or manually sanitize input in radiomobile_front.php.
🔧 Temporary Workarounds
Input Validation and Output Encoding
allManually sanitize stationid parameter in radiomobile_front.php to prevent XSS
Edit radiomobile_front.php and apply htmlspecialchars() or similar encoding to stationid parameter before output
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block XSS patterns in stationid parameter
Configure WAF to detect and block <script>, javascript:, and other XSS patterns in query strings
🧯 If You Can't Patch
- Restrict access to admin interface using network segmentation or IP whitelisting
- Implement Content Security Policy (CSP) headers to mitigate script injection impact
🔍 How to Verify
Check if Vulnerable:
Test by accessing radiomobile_front.php?stationid=<script>alert('XSS')</script> as admin and check if script executesCheck Version:
Check SVXportal version in configuration files or admin interfaceVerify Fix Applied:
Verify that script tags in stationid parameter are properly encoded in HTML output📡 Detection & Monitoring
Log Indicators:
- HTTP requests to radiomobile_front.php with script patterns in stationid parameter
- Unusual admin session activities
Network Indicators:
- HTTP traffic containing XSS payloads in stationid parameter
SIEM Query:
source="web_logs" AND uri="*radiomobile_front.php*" AND query="*stationid=*script*"