CVE-2025-10367: RPi-Jukebox-RFID XSS Vulnerability

CVE-2025-10367 Overview

CVE-2025-10367 is a cross-site scripting (XSS) vulnerability in MiczFlor RPi-Jukebox-RFID versions up to 2.8.0. The flaw resides in unspecified functionality of the /htdocs/cardEdit.php file. Attackers can inject arbitrary script content through unsanitized input, which the application renders back in a victim's browser session. The vulnerability is remotely exploitable and requires user interaction combined with low-privileged access. The exploit details have been publicly disclosed. The vendor was contacted before disclosure but did not respond. This weakness is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
An authenticated remote attacker can inject malicious JavaScript through cardEdit.php, enabling session-context script execution against other users of the RPi-Jukebox-RFID web interface.

Affected Products

MiczFlor RPi-Jukebox-RFID versions up to and including 2.8.0
The vulnerable component: /htdocs/cardEdit.php
Deployments exposing the RPi-Jukebox-RFID web interface on a reachable network

Discovery Timeline

2025-09-13 - CVE-2025-10367 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10367

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting weakness in the cardEdit.php endpoint of the RPi-Jukebox-RFID web application. The application accepts user-supplied input intended for card editing but fails to properly neutralize special characters before including that input in HTTP responses. As a result, an attacker can supply JavaScript payloads that execute within the browser of any user who views the affected page.

Exploitation requires low-privileged access to the web interface and user interaction, such as an administrator or another user visiting the manipulated page. Because RPi-Jukebox-RFID is typically deployed on a Raspberry Pi within a home or small office network, successful XSS can be used to hijack session cookies, perform actions on behalf of the victim, or pivot into further browser-based attacks. Public proof-of-concept material is available at the GitHub PoC for XSS.

Root Cause

The root cause is missing or inadequate output encoding when user-controlled parameters submitted to /htdocs/cardEdit.php are rendered back into HTML. The application does not apply context-aware escaping (for example, HTML entity encoding for element content or attribute encoding for attributes), allowing arbitrary markup and script tags to reach the DOM.

Attack Vector

The attack vector is network-based. An attacker with low-privileged access to the RPi-Jukebox-RFID interface crafts a request to cardEdit.php containing an XSS payload. A victim with valid access must load the affected page to trigger execution. See the VulDB #323775 CVE Details entry for additional metadata.

No verified sanitized exploitation code is published beyond the referenced proof-of-concept. Refer to the GitHub PoC for XSS Reference for technical details.

Detection Methods for CVE-2025-10367

Indicators of Compromise

HTTP requests to /htdocs/cardEdit.php containing <script>, onerror=, onload=, javascript:, or encoded variants of these strings in query or POST parameters.
Unexpected outbound requests from browsers of RPi-Jukebox-RFID users to attacker-controlled hosts shortly after visiting the card edit page.
Anomalous session activity or configuration changes performed from browser sessions of legitimate administrators.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect parameters submitted to cardEdit.php for HTML tag and event handler patterns.
Enable and monitor web server access logs for requests to cardEdit.php containing suspicious characters such as <, >, ", and %3C.
Correlate browser-side Content Security Policy (CSP) violation reports with server-side request patterns to identify injection attempts.

Monitoring Recommendations

Alert on HTTP 200 responses to cardEdit.php requests whose parameters contain script-related tokens.
Track authenticated sessions accessing the RPi-Jukebox-RFID interface from unexpected source addresses.
Review browser console logs and CSP reports on managed administrator endpoints for evidence of blocked script execution.

How to Mitigate CVE-2025-10367

Immediate Actions Required

Restrict network access to the RPi-Jukebox-RFID web interface to trusted management networks only using host or network firewall rules.
Require unique, strong credentials for all users of the RPi-Jukebox-RFID application and rotate any shared credentials.
Educate administrators to avoid clicking untrusted links that reference the jukebox interface until a fix is available.

Patch Information

At the time of NVD publication, no vendor patch or advisory is available. The vendor did not respond to disclosure attempts. Operators should monitor the MiczFlor RPi-Jukebox-RFID project for future releases addressing this issue and review the VulDB #323775 Overview for tracking updates.

Workarounds

Place the jukebox interface behind a reverse proxy that enforces a strict Content Security Policy disallowing inline scripts and unknown script sources.
Disable or block public exposure of /htdocs/cardEdit.php if the card editing functionality is not required.
Serve the application behind an authenticating reverse proxy with request filtering to strip HTML metacharacters from query strings and form fields.

bash

# Example nginx reverse proxy hardening with CSP and access restriction
server {
    listen 443 ssl;
    server_name jukebox.local;

    # Restrict access to management subnet
    allow 192.168.10.0/24;
    deny all;

    # Enforce Content Security Policy to mitigate XSS execution
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;

    location /htdocs/cardEdit.php {
        # Optionally block the vulnerable endpoint entirely
        # return 403;
        proxy_pass http://127.0.0.1:80;
    }
}