PT-2026-22961 · Freesms · Freesms

Yilmaz Degirmenci · Publicado 2026-03-04 · Atualizado 2026-03-04 · CVE-2019-25506

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeSMS version 2.1.2

Description The software contains a boolean-based blind SQL injection issue in the password parameter. This allows unauthenticated attackers to bypass authentication by injecting SQL code through the login endpoint. Attackers can exploit the vulnerable password parameter in requests to the /pages/crc handler.php?method=login endpoint to authenticate as any known user and subsequently modify their password via the profile update function. The vulnerable parameter is password.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /pages/crc handler.php?method=login endpoint. Avoid using the password parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-25506

Produtos afetados

Freesms

Referências · 4

• 🔥 https://exploit-db.com/exploits/46658 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25506 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-25506 · Aviso do Fabricante
• https://vulncheck.com/advisories/freesms-authentication-bypass-via-sql-injection · Nota