[ CVE-2020-8644 · Published 5 Feb 2020 ]
PlaySMS Server-Side Template Injection Vulnerability
Exploited · CISA KEV CVSS 9.8
EPSS 87%No fix listed yet
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
- EPSS: 87% chance of exploitation in the next 30 days (higher than 100% of CVEs)
- Critical severity: CVSS 9.8
[ Description ]Official description
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
CISA: PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injecti…ExploitThird Party AdvisoryVDB Entry
- forum.playsms.org/t/playsms-1-4-3-has-been-released/2704Broken LinkRelease NotesVendor Advisory
- playsms.org/2020/02/05/playsms-1-4-3-has-been-releasedVendor Advisory
- research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-c…Exploit
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource