{"uuid": "44e9606e-dad0-4490-80d5-5a25074a8618", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8644", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/playsms_template_injection.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Touhid M.Shaikh \", \"Lucas Rosevear\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a preauth Server-Side Template Injection vulnerability that leads to remote code execution\\n          in PlaySMS before version 1.4.3. This issue is caused by double processing a server-side template with a custom\\n          PHP template system called 'TPL' which is used in the PlaySMS template engine at\\n          `src/Playsms/Tpl.php:_compile()`. The vulnerability is triggered when an attacker supplied username with a\\n          malicious payload is submitted. This malicious payload is then stored in a TPL template which when rendered a\\n          second time, results in code execution.\\n          The TPL(https://github.com/antonraharja/tpl) template language is vulnerable to PHP code injection.\\n\\n          This module was tested against PlaySMS 1.4 on HackTheBox's Forlic Machine.\", \"disclosure_date\": \"2020-02-05\", \"fullname\": \"exploit/multi/http/playsms_template_injection\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"PlaySMS index.php Unauthenticated Template Injection Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/playsms_template_injection.rb\", \"platform\": \"PHP\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/playsms_template_injection\", \"references\": [\"CVE-2020-8644\", \"URL-https://www.youtube.com/watch?v=zu-bwoAtTrc\", \"URL-https://research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PlaySMS Before 1.4.3\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:09.335539Z"}