CVE-2024-8880 playSMS Template index.php code injection
Remote attackers can execute arbitrary code via code injection in the playSMS template handler, requiring high complexity and permissions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-8880?
CVE-2024-8880 is a medium-severity code injection vulnerability in playSMS, published on 16 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /playsms/index.php?app=main&inc=core_auth&route=forgot&op=forgot of the component Template Handler. The manipulation of the argument username/email/captcha leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The project maintainer was informed early about the issue. Investigation shows that playSMS up to 1.4.3 contained a fix but later versions re-introduced the flaw. As long as the latest version of the playsms/tpl package is used, the software is not affected. Version >=1.4.4 shall fix this issue for sure.
Weakness: CWE-94
Which versions are affected by CVE-2024-8880?
It affects 1 product.
Products include Playsms Playsms.
How do I fix CVE-2024-8880?
No fix has been published for CVE-2024-8880 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-8880 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-8880 exists.
Other vulnerabilities in playSMS
Sources
Also known as GHSA-h478-hrvj-hrjq.