SVXportal Reflected Cross-Site Scripting Vulnerability in radiomobile_front.php

A reflected cross-site scripting vulnerability has been identified in SVXportal versions through 2.5. The issue resides in the radiomobile_front.php file, specifically within the stationid query parameter. When an authenticated administrator accesses a crafted URL, the application injects the unsanitized parameter value into a hidden input field. This vulnerability allows for the injection and execution of attacker-supplied scripts in the administrator's browser, potentially compromising admin sessions or enabling unauthorized actions within the administrator's authenticated context.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute scripts in the context of the victim's browser session.