180 matches found
PlaySMS index.php Unauthenticated Template Injection Code Execution
This module exploits a preauth Server-Side Template Injection vulnerability that leads to remote code execution in PlaySMS before version 1.4.3. This issue is caused by double processing a server-side template with a custom PHP template system called 'TPL' which is used in the PlaySMS template...
CVE-2020-8644
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string. Recent assessments: touhidshaikh at March 12, 2020 4:40pm UTC reported: Description This module exploits a Preauth Server-Side Template Injection leads remote code execution vulnerability in PlaySMS Before Version 1.4.3. This...
playSMS Elevation of Privilege Vulnerability
PlaySMS is a web-based SMS platform. The platform supports connectivity to SMS gateways, personal messaging systems, and corporate group communication tools. A power-up vulnerability exists in PlaySMS 1.4.2 and earlier versions. No detailed vulnerability details are provided at this time...
CVE-2018-18387
playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse...
CVE-2018-18387
playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse...
Privilege escalation
playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse...
CVE-2018-18387
playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse...
CVE-2018-18387
PlaySMS prior to or at version 1.4.2 is affected by a Privilege Escalation vulnerability described as abuse of the daemon process. Connected sources corroborate that PlaySMS is a web-based SMS platform and that the vulnerability is present in PlaySMS 1.4.2 and earlier. The exact root-cause detail...
PlaySMS 1.4 - sendfromfile.php?Filename Authenticated Code Execution Exploit
This Metasploit module exploits a code injection vulnerability within an authenticated file upload feature in PlaySMS version 1.4. This issue is caused by improper file name handling in sendfromfile.php file. Authenticated Users can upload a file and rename the file with a malicious payload. This...
PlaySMS 1.4 - import.php Authenticated CSV File Upload Code Execution Exploit
This Metasploit module exploits an authenticated file upload remote code execution vulnerability in PlaySMS version 1.4. This issue is caused by improper file contents handling in import.php aka the Phonebook import feature. Authenticated Users can upload a CSV file containing a malicious payload...
PlaySMS 1.4 - 'sendfromfile.php?Filename' (Authenticated) 'Code Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PlaySMS sendfromfile.php Authenticated "Filename" Field Code Execution', 'Description' = %q This module exploits a code injection vulnerability...
PlaySMS - 'import.php' (Authenticated) CSV File Upload Code Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PlaySMS import.php Authenticated CSV File Upload Code Execution', 'Description' = %q This module exploits an authenticated file upload remote cod...
PlaySMS import.php Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PlaySMS import.php Authenticated CSV File Upload Code Execution', 'Description' = %q This module exploits an authenticated file upload remote cod...
PlaySMS sendfromfile.php Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PlaySMS sendfromfile.php Authenticated "Filename" Field Code Execution', 'Description' = %q This module exploits a code injection vulnerability...
PlaySMS Remote Code Execution Vulnerability
PlaySMS is a web-based SMS platform. The platform supports connectivity to SMS gateways, personal messaging systems, and corporate group communication tools. A remote code execution vulnerability exists in the sendfromfile.php file in PlaySMS version 1.4. A remote attacker can exploit this...
PlaySMS Remote Code Execution Vulnerability (CNVD-2017-08174)
PlaySMS is a web-based SMS platform. The platform supports connectivity to SMS gateways, personal messaging systems, and corporate group communication tools. A remote code execution vulnerability exists in the import.php file a.k.a. phonebook import function in PlaySMS version 1.4. A remote...
PlaySMs Remote Code Execution Vulnerability (CNVD-2017-10344)
PlaySMS is an open source WEB SMS platform. A remote code execution vulnerability exists in PlaySms. The vulnerability stems from the address book calling a function in import.php. An attacker can exploit the vulnerability to execute malicious code...
CVE-2017-9101
import.php aka the Phonebook import feature in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file...
Remote code execution
import.php aka the Phonebook import feature in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file...