CVE-2024-6470

A vulnerability was found in playSMS 1.4.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php?app=main&inc=feature_inboxgroup&op=list of the component Template Handler. The manipulation of the argument Receiver Number with the input {{`id`}} leads to injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-270278 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Configurations

No configuration.

History

05 Jul 2024, 12:55

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en playSMS 1.4.3. Ha sido calificada como problemática. Una función desconocida del archivo /index.php?app=main&inc=feature_inboxgroup&op=list del componente Template Handler es afectada por esta vulnerabilidad. La manipulación del argumento Número de receptor con la entrada {{`id`}} conduce a la inyección. El ataque puede lanzarse de forma remota. El exploit ha sido divulgado al público y puede utilizarse. VDB-270278 es el identificador asignado a esta vulnerabilidad. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera.

03 Jul 2024, 13:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-07-03 13:15

Updated : 2024-07-05 12:55


NVD link : CVE-2024-6470

Mitre link : CVE-2024-6470

CVE.ORG link : CVE-2024-6470


JSON object : View

Products Affected

No product.

CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')