PlaySMS Server-Side Template Injection Vulnerability

Description

References

• packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injection-Code-Execution.html · Exploit
• forum.playsms.org/t/playsms-1-4-3-has-been-released/2704 · Broken Link
• playsms.org/2020/02/05/playsms-1-4-3-has-been-released · Vendor Advisory
• research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644 · Exploit
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2020-8644

Altre vulnerabilità di playsms

• CVE-2024-8880CRITICO 9.8A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /plays…
• CVE-2024-6470BASSO 2.7A vulnerability was found in playSMS 1.4.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the fi…
• CVE-2024-6469ALTO 8.8A vulnerability was found in playSMS 1.4.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality …
• CVE-2024-6251MEDIO 6.1A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Affected is an unknown function of the file /index.php?app…
• CVE-2022-47034CRITICO 9.8A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.