CVE-2025-10368: RPi-Jukebox-RFID XSS Vulnerability

CVE-2025-10368 Overview

CVE-2025-10368 is a cross-site scripting (XSS) vulnerability in MiczFlor RPi-Jukebox-RFID versions up to 2.8.0. The flaw resides in the /htdocs/manageFilesFolders.php script, where unsanitized input allows an attacker to inject arbitrary JavaScript into the application. Exploitation requires an authenticated remote attacker and user interaction to trigger the injected payload. The vendor was contacted about the disclosure but did not respond, and public proof-of-concept material is available. The vulnerability is tracked under CWE-79.

Critical Impact
Authenticated attackers can inject JavaScript into the RPi-Jukebox-RFID web interface, enabling session-context script execution against other users of the jukebox management console.

Affected Products

MiczFlor RPi-Jukebox-RFID versions up to and including 2.8.0
Component: /htdocs/manageFilesFolders.php
Vendor: sourcefabric (rpi-jukebox-rfid)

Discovery Timeline

2025-09-13 - CVE-2025-10368 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10368

Vulnerability Analysis

The vulnerability is a reflected or stored cross-site scripting weakness in the RPi-Jukebox-RFID web management interface. The /htdocs/manageFilesFolders.php endpoint processes user-supplied input without applying sufficient output encoding or input sanitization. An attacker with low-level privileges to the application can submit a crafted payload that is rendered back into the HTML response context, causing the browser to execute the attacker's JavaScript. Because RPi-Jukebox-RFID is often deployed on home and hobbyist Raspberry Pi devices reachable on local networks, exploitation typically targets other authenticated administrators of the jukebox interface.

Root Cause

The root cause is improper neutralization of input during web page generation, classified as CWE-79. The manageFilesFolders.php script reflects request parameters into the HTML response without HTML-entity encoding or contextual escaping. PHP applications that concatenate user input into templates without using functions such as htmlspecialchars() or htmlentities() produce this class of defect.

Attack Vector

Exploitation occurs over the network against the jukebox web interface. The attacker must have low-privilege access to the application and must convince a target user to load a crafted URL or view a page containing the injected content. Once executed, the payload runs under the origin of the RPi-Jukebox-RFID web application, giving the attacker access to session cookies, CSRF tokens, and any actions the victim can perform in the management console.

No verified exploitation code is reproduced here. Public proof-of-concept content is available through the GitHub PoC for XSS and the VulDB #323776 Report.

Detection Methods for CVE-2025-10368

Indicators of Compromise

HTTP requests to /htdocs/manageFilesFolders.php containing HTML tag characters, <script> fragments, or JavaScript event handlers such as onerror= or onload=.
Web server access logs showing URL-encoded payloads (for example %3Cscript%3E) targeting parameters handled by manageFilesFolders.php.
Unexpected outbound requests from administrator browsers to attacker-controlled hosts shortly after visiting the jukebox management interface.

Detection Strategies

Deploy a web application firewall (WAF) rule set that flags XSS payload patterns against manageFilesFolders.php request parameters.
Review PHP application logs and Apache or Nginx access logs for anomalous query strings and POST bodies targeting the file and folder management endpoint.
Correlate authenticated session activity with browser errors or unexpected DOM modifications reported by users of the jukebox web console.

Monitoring Recommendations

Monitor for new or modified files under the /htdocs/ directory that could indicate stored payload persistence.
Alert on administrator sessions originating from unusual IP addresses or user agents accessing the RPi-Jukebox-RFID management interface.
Enable HTTP response header logging to detect the absence of protective headers such as Content-Security-Policy and X-XSS-Protection on responses from the affected endpoint.

How to Mitigate CVE-2025-10368

Immediate Actions Required

Restrict network access to the RPi-Jukebox-RFID web interface so that only trusted local hosts can reach /htdocs/manageFilesFolders.php.
Remove or disable public exposure of the jukebox management console on any internet-facing network segment.
Rotate any administrator credentials that may have been used from browsers exposed to the vulnerable interface.

Patch Information

At the time of publication, the vendor has not responded to the disclosure and no official patch is referenced in the advisory. Track the VulDB #323776 Details entry and the upstream project repository for future fixes. Until a patch is released, treat all versions up to 2.8.0 as vulnerable.

Workarounds

Place the jukebox management interface behind a reverse proxy with authentication and a strict Content-Security-Policy header that disallows inline scripts.
Apply a WAF rule that rejects requests to /htdocs/manageFilesFolders.php containing <, >, or JavaScript event-handler substrings.
Instruct administrators to access the management console from a dedicated browser profile that does not share cookies or extensions with general browsing.

bash

# Example Nginx location block restricting access to trusted subnet
location /htdocs/manageFilesFolders.php {
    allow 192.168.1.0/24;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
    add_header X-Content-Type-Options "nosniff";
    proxy_pass http://127.0.0.1:8080;
}