CVE-2024-13982 — SPON IP Network Intercom System rj_get_token.php Arbitrary File Read
SPON IP Network Broadcast System, a digital audio transmission platform developed by SPON Communications, contains an arbitrary file read vulnerability in the rj_get_token.php e…
Published: 2025-08-27 · CVSS: 8.7 · CVSS 4.0
SPON IP Network Broadcast System, a digital audio transmission platform developed by SPON Communications, contains an arbitrary file read vulnerability in the rj_get_token.php endpoint. The flaw arises from insufficient input validation on the jsondata[url] parameter, which allows attackers to perform directory traversal and access sensitive files on the server. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted POST request to read arbitrary files, potentially exposing system configuration, credentials, or internal logic. An affected version range is undefined.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7