PT-2009-2801 · Playsms · Playsms

Ahmadbady · Published 2009-01-09 · Updated 2017-09-29 · CVE-2009-0103

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions playSMS version 0.9.3

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via a URL in the following parameters: apps path[plug] to "plugin/gateway/gnokii/init.php", apps path[themes] to "plugin/themes/default/init.php", and apps path[libs] to "lib/function.php".

Recommendations For playSMS version 0.9.3, consider restricting access to the apps path[plug], apps path[themes], and apps path[libs] parameters in the respective PHP files until a patch is available. Avoid using these parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-0103

Affected Products

Playsms

References · 6

• 🔥 https://exploit-db.com/exploits/7687 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0103 · Security Note
• http://secunia.com/advisories/33386 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0103 · Note
• http://securityfocus.com/bid/33138 · Note
• http://securityreason.com/securityalert/4888 · Note