Lyrion Music Server Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the web interface of Lyrion Music Server versions through 9.0.3. This vulnerability allows an authenticated user with access to the Settings Player to inject arbitrary HTML or JavaScript into the Player name field. The injected content is saved by the server and later displayed on the Information (Player Info) tab without proper output encoding, enabling the script to execute in the context of any user viewing the page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.