CVE-2025-10369: RPi-Jukebox-RFID XSS Vulnerability

CVE-2025-10369 Overview

CVE-2025-10369 is a cross-site scripting (XSS) vulnerability affecting MiczFlor RPi-Jukebox-RFID versions up to 2.8.0. The flaw resides in the /htdocs/cardRegisterNew.php file, where unsanitized input allows attackers to inject arbitrary script content. The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

An attacker can exploit the vulnerability remotely over the network with low privileges and user interaction. The exploit has been publicly disclosed. The vendor was contacted before public disclosure but did not respond.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the browser context of a victim interacting with the RPi-Jukebox-RFID web interface, enabling session hijacking, credential theft, or unauthorized actions on the jukebox device.

Affected Products

MiczFlor RPi-Jukebox-RFID versions up to and including 2.8.0
The vulnerable component: /htdocs/cardRegisterNew.php
Deployments exposing the RPi-Jukebox-RFID web interface to untrusted networks

Discovery Timeline

2025-09-13 - CVE-2025-10369 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10369

Vulnerability Analysis

The vulnerability exists in the cardRegisterNew.php script, which handles card registration functionality in the RPi-Jukebox-RFID web application. User-supplied input is reflected in the HTTP response without proper encoding or sanitization. An authenticated attacker with low privileges can craft a malicious payload that executes JavaScript when a victim loads the affected page.

Because exploitation requires user interaction, attackers typically deliver the payload through phishing links or embedded content pointing to the vulnerable endpoint. The public disclosure of exploitation details on GitHub increases the likelihood of opportunistic use against exposed instances.

Root Cause

The root cause is missing output encoding on parameters processed by /htdocs/cardRegisterNew.php. The application accepts user-controlled input and renders it directly into HTML without applying context-aware escaping. This aligns with the classic pattern described in [CWE-79], where the server fails to neutralize special characters before returning them in dynamically generated web content.

Attack Vector

Exploitation occurs over the network against systems exposing the RPi-Jukebox-RFID web interface. An attacker authenticated as a low-privilege user submits crafted input to the vulnerable endpoint, then persuades another user to visit a URL that reflects the payload. Technical proof-of-concept details are documented in the GitHub XSS Vulnerability Analysis and companion write-up.

The vulnerability details are also cataloged in VulDB entry 323777. No verified exploit code is included here.

Detection Methods for CVE-2025-10369

Indicators of Compromise

HTTP requests to /htdocs/cardRegisterNew.php containing <script>, javascript:, onerror=, or URL-encoded equivalents in query parameters or POST bodies
Reflected responses from the endpoint containing unescaped HTML tags submitted by clients
Unusual outbound requests from users' browsers to attacker-controlled domains shortly after visiting jukebox web pages

Detection Strategies

Inspect web server access logs for anomalous character sequences targeting cardRegisterNew.php
Deploy web application firewall (WAF) rules that flag common XSS payload patterns on RPi-Jukebox-RFID endpoints
Enable Content Security Policy (CSP) violation reporting to surface script execution attempts from untrusted sources

Monitoring Recommendations

Alert on repeated failed input validation attempts targeting card registration pages
Monitor browser session anomalies for users administering RPi-Jukebox-RFID devices, such as unexpected cookie exfiltration
Track network egress from devices hosting the jukebox interface for connections to unfamiliar external hosts

How to Mitigate CVE-2025-10369

Immediate Actions Required

Restrict access to the RPi-Jukebox-RFID web interface to trusted internal networks only, using firewall rules or reverse proxy authentication
Disable or remove the cardRegisterNew.php functionality if card registration is not actively used
Require administrators to log out of the jukebox interface before browsing untrusted content in the same session

Patch Information

At the time of publication, no vendor patch is available. The maintainer of MiczFlor RPi-Jukebox-RFID was contacted about this disclosure but did not respond. Monitor the RPi-Jukebox-RFID GitHub repository for future security releases beyond version 2.8.0.

Workarounds

Place the jukebox web interface behind an authenticating reverse proxy that strips or validates request parameters
Enforce a strict Content Security Policy that blocks inline script execution on the jukebox web application
Educate users with access to the interface about phishing links that reference the jukebox host

bash

# Example nginx configuration to restrict access and add CSP headers
location /htdocs/cardRegisterNew.php {
    allow 192.168.1.0/24;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";
    add_header X-XSS-Protection "1; mode=block";
}