Executive brief
Zuz Music, a platform for managing music systems, contains a security flaw in its public contact form. An unauthorized person can send a specially crafted message that includes malicious code. When an administrator later views this message in their management dashboard, the code automatically runs, potentially allowing the attacker to hijack the administrator's session or perform unauthorized actions on the site.
Technical details
A persistent cross-site scripting (XSS) vulnerability exists in Zuz Music 2.1 due to improper neutralization of user-supplied input in the contact form. Unauthenticated attackers can submit POST requests to the `/gmusic/zuzconsole/___contact` endpoint containing malicious JavaScript in the 'name', 'subject', or 'message' parameters. Because the application fails to sanitize this data before storage, the script is executed in the context of an administrator's browser session when they view the message via the inbox interface at `/gmusic/admin/inbox`. This can lead to session hijacking, unauthorized administrative actions, or further exploitation of the management console.
Affected products
- Zuz Music Zuz Music 2.1
Timeline
- 2019-02-14: disclosed: Vulnerability discovered by researcher
- 2019-02-19: other: Exploit published on Exploit-DB
- 2026-06-04: advisory: CVE published/updated in NVD