Listen to this Post
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw arising from insecure XML construction. The affected Mozart FM Transmitter software uses a `patchlist.xml` file to manage audio patch data. When a user uploads a file, the system uses the uploaded filename without proper sanitization and directly concatenates it into the `patchlist.xml` document structure. An attacker can craft a malicious filename containing JavaScript payloads within XML tags or attributes, for example: <img src=x onerror=alert(document.cookie)>.bin. This tainted filename is then written directly into the `patchlist.xml` file. Later, when the web interface’s `ajax.js` script fetches and processes this XML file to display the patch list, it interprets the injected script tags or event handlers as legitimate HTML/JavaScript, causing the attacker’s code to execute in the context of the victim’s browser session. This stored XSS does not require further interaction and affects all users who view the compromised patch list.
Platform: DB Electronica Mozart Transmitter
Version: 30,50,100,300,500,1000,2000,3000,3500,6000,7000
Vulnerability: XML Injection XSS
Severity: Critical
date: 2025-11-25
Prediction: 2026-02-01
What Undercode Say:
grep -r "patchlist.xml" /var/www/
<!-- Malicious entry in patchlist.xml --> <file><name><img src=x onerror=alert(1)>.bin</name><size>0</size></file>
curl -X POST -F "[email protected]" http://target/upload
How Exploit:
1. Upload maliciously named file.
2. Payload writes to `patchlist.xml`.
3. Victim views patch list page.
4. `ajax.js` renders payload.
5. Attacker script executes.
Protection from this CVE
- Sanitize filename input.
- Encode XML special characters.
- Use allowlists for filenames.
- Implement Content Security Policy.
Impact:
- Session hijacking
- Admin credential theft
- Complete system compromise
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
