MiczFlor RPi-Jukebox-RFID Command Injection Vulnerability in Shuffle.php

A command injection vulnerability has been identified in MiczFlor RPi-Jukebox-RFID versions through 2.8.0. The issue resides in the file /htdocs/api/playlist/shuffle.php, where the 'playlist' argument can be manipulated to inject operating system commands. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for remote command execution on the server where RPi-Jukebox-RFID is running.

Reproduction

To reproduce this vulnerability, send a PUT request to /api/playlist/shuffle.php with a JSON payload that includes a crafted 'playlist' value designed to inject OS commands. The 'shuffle' field should be set to 'true' to trigger the command execution.