CVE-2026-27504: Radioinorr Svxportal XSS Vulnerability

CVE-2026-27504 Overview

CVE-2026-27504 is a reflected cross-site scripting (XSS) vulnerability affecting SVXportal version 2.5 and prior versions. The vulnerability exists in the radiomobile_front.php file, where the stationid query parameter is embedded into a hidden input field without proper sanitization. When an authenticated administrator visits a crafted URL, attacker-supplied JavaScript can execute within the administrator's browser session, potentially leading to session hijacking or unauthorized administrative actions.

Critical Impact

Attackers can compromise administrator sessions and perform unauthorized actions through the administrator's authenticated context by exploiting this reflected XSS vulnerability.

Affected Products

• SVXportal version 2.5 and prior
• Radioinorr SVXportal (all versions up to 2.5)

Discovery Timeline

• 2026-02-20 - CVE-2026-27504 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-27504

Vulnerability Analysis

This reflected cross-site scripting vulnerability stems from improper input handling in the radiomobile_front.php script. The application takes user-supplied input from the stationid query parameter and directly embeds it into a hidden input field within the HTML response. Because the application fails to sanitize or encode the parameter value before rendering it in the page, an attacker can inject malicious JavaScript code that executes in the context of the victim's browser.

The attack requires user interaction—specifically, an authenticated administrator must click on or visit a malicious URL containing the XSS payload. Once executed, the injected script runs with the same privileges as the administrator, enabling session token theft, unauthorized configuration changes, or further attacks against the underlying system.

Root Cause

The root cause is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability. The radiomobile_front.php script does not implement proper output encoding when reflecting the stationid parameter value into the HTML document. The parameter is placed directly into a hidden input element's value attribute without escaping special HTML characters such as quotes, angle brackets, or script tags.

Attack Vector

The attack is network-based and requires an attacker to craft a malicious URL containing JavaScript payload in the stationid parameter. The attacker then needs to trick an authenticated administrator into visiting this URL through social engineering techniques such as phishing emails or malicious links. When the administrator accesses the crafted URL while authenticated to SVXportal, the malicious script executes within their browser session.

The attacker can leverage this vulnerability to steal session cookies, capture administrator credentials, modify portal configurations, or redirect the administrator to attacker-controlled sites. Since the script executes within the authenticated context, any administrative functions accessible to the victim become available to the attacker.

Detection Methods for CVE-2026-27504

Indicators of Compromise

• Unusual URL patterns in web server logs containing suspicious JavaScript code in the stationid parameter
• Requests to radiomobile_front.php with encoded or obfuscated script tags in query strings
• Unexpected session activity or administrative changes following access to anomalous URLs
• Browser security warnings or Content Security Policy violations logged on administrator workstations

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing script tags or event handlers in the stationid parameter
• Monitor web server access logs for requests to radiomobile_front.php with suspicious query string patterns
• Deploy endpoint detection solutions to identify XSS payload execution attempts in browser environments
• Enable Content Security Policy (CSP) headers to restrict inline script execution and detect policy violations

Monitoring Recommendations

• Configure SIEM alerts for requests containing common XSS patterns targeting the vulnerable endpoint
• Enable verbose logging on the SVXportal application to capture all parameter values passed to radiomobile_front.php
• Monitor administrator session activity for signs of hijacking or unauthorized actions following URL access
• Review browser console logs on administrator workstations for script injection indicators

How to Mitigate CVE-2026-27504

Immediate Actions Required

• Restrict access to the SVXportal administrative interface to trusted IP addresses only
• Implement Content Security Policy headers to prevent inline script execution
• Deploy a web application firewall with rules to block XSS payloads in query parameters
• Educate administrators about the risks of clicking untrusted links while authenticated

Patch Information

No official vendor patch information is available at this time. Organizations should monitor the VulnCheck Security Advisory for updates regarding fixes from the vendor. Additionally, the affected source code is available for review on GitHub.

Workarounds

• Apply input validation on the stationid parameter to accept only expected alphanumeric values
• Implement HTML entity encoding for all user-supplied values before rendering them in HTML output
• Add Content-Security-Policy headers with strict script-src directives to prevent inline JavaScript execution
• Consider placing the administrative interface behind a VPN or implementing additional authentication factors

# Example Apache configuration to add CSP headers
# Add to .htaccess or httpd.conf for SVXportal
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"