MiczFlor RPi-Jukebox-RFID Command Injection Vulnerability in playsinglefile.php

A command injection vulnerability has been identified in MiczFlor RPi-Jukebox-RFID versions prior to 2.8.0. The issue resides in the file /htdocs/api/playlist/playsinglefile.php, where the 'file' parameter is manipulated to execute arbitrary operating system commands. This vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server where RPi-Jukebox-RFID is running.

Reproduction

To reproduce this vulnerability, send a GET request to /api/playlist/playsinglefile.php with the 'file' parameter. The value of the 'file' parameter should be crafted to include a command injection payload, such as closing the single quote and appending a command, like 'id' to be executed on the server. This can be done by using a value like 'test';id>'