CVE-2020-8644
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- February 05, 2020
- Published Date
- February 05, 2020
- Last Updated
- February 04, 2025
- Vendor
- n/a
- Product
- n/a
- Description
- PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
CVSS Scores
SSVC Information
- Exploitation
- active
- Automatable
- Yes
- Technical Impact
- total
Exploit Status
- Exploited in the Wild
- Yes (added 2021-11-03 00:00:00 UTC) Source
References
https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/
https://forum.playsms.org/t/playsms-1-4-3-has-been-released/2704
https://research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644/
http://packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injection-Code-Execution.html
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| CISA | 2021-11-03 00:00:00 UTC |
Scanner Integrations
| Scanner | URL | Date Detected |
|---|---|---|
| Metasploit | https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/playsms_template_injection.rb | 2025-04-29 11:01:23 UTC |
| Nuclei | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8644.yaml | 2025-04-26 00:00:00 UTC |
Potential Proof of Concepts
Warning: These PoCs have not been tested and could contain malware. Use at your own risk.
playsms_template_injection
Type: metasploit • Created: Unknown
Metasploit module for CVE-2020-8644