CVE-2019-25731: Stored XSS in Zuz Music 2.1 Contact Form

Technical summary

CVE-2019-25731 is a stored cross-site scripting (XSS) vulnerability in Zuz Music 2.1's contact form handler at the endpoint /gmusic/zuzconsole/___contact. The vulnerability stems from insufficient input validation and output encoding on the name, subject, and message POST parameters. An unauthenticated attacker can craft a request containing JavaScript payloads in any of these fields; the application stores these payloads without sanitization. When an administrator accesses the inbox to review contact submissions, the stored script executes within the administrator's browser context with the same privileges and session rights, enabling unauthorized actions within the application's scope.

Business impact

This vulnerability directly threatens administrative operations and data security. Attackers can exploit administrator sessions to alter account settings, modify application configurations, access sensitive customer or system data, or escalate privileges. The attack requires no special access—an attacker can send a crafted contact form from anywhere on the internet. The persistent nature means the malicious payload remains active until manually removed, potentially affecting multiple administrators over time. Organizations relying on Zuz Music for contact management face ongoing risk until the vulnerability is patched.

Affected systems

Zuz Music version 2.1 is affected. The vulnerability exists in the contact form processing logic accessible at /gmusic/zuzconsole/___contact. Any installation of this version is vulnerable to exploitation via unauthenticated POST requests. Earlier or later versions of Zuz Music may or may not be affected; verify your specific version against vendor advisories.

Exploitability

This vulnerability has a low complexity attack surface. No special tools, authentication, or user interaction on the attacker's side is required—an attacker simply needs to craft a POST request with malicious JavaScript in the form fields. However, the vulnerability does require administrator interaction: a victim (administrator) must view the injected message for the payload to execute. The attack succeeds in current and future sessions until the message is deleted. The network-accessible nature and lack of authentication requirements keep the barrier to exploitation very low.

Remediation

The primary remediation is to upgrade Zuz Music to a patched version that properly sanitizes and encodes user input from contact forms. In the interim, apply input validation to reject or neutralize script tags and JavaScript protocols in the name, subject, and message fields. Configure Content Security Policy (CSP) headers to restrict inline script execution. Additionally, review the inbox for any suspicious contact submissions and delete them to prevent payload execution during administrative access.

Patch guidance

Contact the Zuz Music vendor or check their official release notes for patched versions addressing this XSS vulnerability. Apply the patch to all Zuz Music installations in your environment. Verify the patch by confirming that the application properly escapes HTML special characters and sanitizes user input before storage. Test the contact form with known XSS payloads (e.g., <script>alert('XSS')</script>) to confirm they are no longer executed when viewed by administrators.

Detection guidance

Monitor HTTP POST requests to /gmusic/zuzconsole/___contact for payloads containing script tags, event handlers (onclick, onerror, etc.), or JavaScript protocol handlers. Examine stored contact form data in the application database for unusual or suspicious entries containing HTML or JavaScript syntax. Review administrator access logs and browser console logs for unexpected script execution or errors when accessing the inbox interface. Implement Web Application Firewall (WAF) rules to block or flag contact submissions containing encoded or obfuscated JavaScript patterns.

Why prioritize this

This vulnerability merits prompt attention despite its MEDIUM CVSS score. The attack surface is broad (unauthenticated, network-accessible), the attack vector is simple, and compromise of administrator accounts can lead to lateral movement, data theft, or further system compromise. The persistent nature amplifies risk—a single injection affects all subsequent administrator interactions. Organizations should prioritize patching within their normal maintenance windows, particularly if their Zuz Music instance handles sensitive customer or operational data.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects several factors: network accessibility with no authentication (AV:N, PR:N) and low attack complexity (AC:L) increase the base score. However, the requirement for administrator interaction (UI:R) and the scope of impact being limited to confidentiality and integrity (C:L, I:L) without availability impact (A:N) moderate the severity. The cross-origin nature (S:C) extends potential impact slightly. The score appropriately captures that while exploitation is straightforward, real-world impact depends on what attackers can accomplish with compromised administrator sessions and whether sensitive data or systems are at stake in your environment.

Frequently asked questions