← Vulnerability feed

Vulnerability record · CVE-2024-8880 · published 16 September 2024

CVE-2024-8880: Playsms code injection vulnerability

Playsms · Playsms

A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /playsms/index.php?app=main&inc=core_auth&route=forgot&op=forgot of the component Template Handler. The manipulation of the argument username/email/captcha leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The project maintainer was informed early about the issue. Investigation shows that playSMS up to 1.4.3 contained a fix but later versions re-introduced the flaw. As long as the latest version of the playsms/tpl package is used, the software is not affected. Version >=1.4.4 shall fix this issue for sure.

6.3 CVSS 4.0 Medium EPSS 0.68% · top 49.3% CWE-94 · Code injection
6.3CVSS 4.0 base score, v2 5.1
0.68%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /playsms/index.php?app=main&inc=core_auth&route=forgot&op=forgot of the component Template Handler. The manipulation of the argument username/email/captcha leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The project maintainer was informed early about the issue. Investigation shows that playSMS up to 1.4.3 contained a fix but later versions re-introduced the flaw. As long as the latest version of the playsms/tpl package is used, the software is not affected. Version >=1.4.4 shall fix this issue for sure.

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://vuldb.com/?ctiid.277524 Permissions Required
https://vuldb.com/?id.277524 Third Party Advisory
https://vuldb.com/?submit.406095 ExploitThird Party Advisory

Track CVE-2024-8880 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-8644PlaySMS unauthenticated template injection code executionPlaySMS before 1.4.3 fails to sanitize input from a malicious string, allowing server-side template injection that leads to code execution. The flaw …KEVEPSS 87%analysed9.8CVE-2022-47034Playsms vulnerabilityA type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.EPSS 0.83%9.8CVE-2021-40373Playsms code injection vulnerabilityplaySMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then executing that …EPSS 4.7%9.8CVE-2017-9101PlaySMS Phonebook import allows unauthenticated remote code executionPlaySMS 1.4's import.php Phonebook import feature permits remote code execution through the User-Agent HTTP header and PHP code embedded in a file na…EPSS 77%analysed8.8CVE-2017-9080PlaySMS unrestricted file upload in sendfromfile.php enables RCEPlaySMS 1.4 executes PHP code contained in the name of an uploaded .php file through sendfromfile.php, combining unrestricted file upload with code i…EPSS 62%analysed7.5CVE-2009-0103Playsms code injection vulnerabilityMultiple PHP remote file inclusion vulnerabilities in playSMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) apps_pa…EPSS 10%7.5CVE-2008-5881Playsms path traversal vulnerabilityMultiple directory traversal vulnerabilities in playSMS 0.9.3 allow remote attackers to include and execute arbitrary local files via directory trave…EPSS 7.3%7.5CVE-2004-2263Playsms vulnerabilitySQL injection vulnerability in the valid function in fr_left.php in PlaySMS 0.7 and earlier allows remote attackers to modify SQL statements via the …EPSS 1.4%

Source: NIST National Vulnerability Database (record CVE-2024-8880), CISA KEV, FIRST EPSS (scores of 2026-10-02). This page is refreshed as NVD updates the record.