Actively exploited in the wild
PlaySMS Server-Side Template Injection Vulnerability
PlaySMS - PlaySMS · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-8644
CriticalCVSS 9.8KEVSummary
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
Risk Assessment
An attacker can inject malicious input, potentially leading to code execution or other attacks, compromising the PlaySMS system.
Recommendation
Update PlaySMS to version 1.4.3 or later to fix the input sanitization issue.
Other vulnerabilities in PlaySMS
See all- CVE-2017-9080High
PlaySMS version 1.4 allows remote code execution due to the execution of PHP code in the name of an uploaded .php file. The issue arises from a combination of unrestricted file upload and code injection.
- CVE-2017-9101Critical
In PlaySMS 1.4, the import feature (import.php) allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.
Original NVD description (English source)
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.