CVE-2024-6251

A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Affected is an unknown function of the file /index.php?app=main&inc=feature_phonebook&op=phonebook_list of the component New Phonebook Handler. The manipulation of the argument name/email leads to basic cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269418 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
References
Link Resource
https://vuldb.com/?ctiid.269418 Permissions Required VDB Entry
https://vuldb.com/?id.269418 Third Party Advisory VDB Entry
https://vuldb.com/?submit.355495 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:playsms:playsms:1.4.3:*:*:*:*:*:*:*

History

19 Sep 2024, 16:50

Type Values Removed Values Added
CWE CWE-79
CVSS v2 : 3.3
v3 : 2.4
v2 : 3.3
v3 : 6.1
References () https://vuldb.com/?ctiid.269418 - () https://vuldb.com/?ctiid.269418 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.269418 - () https://vuldb.com/?id.269418 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.355495 - () https://vuldb.com/?submit.355495 - Third Party Advisory, VDB Entry
First Time Playsms
Playsms playsms
CPE cpe:2.3:a:playsms:playsms:1.4.3:*:*:*:*:*:*:*

24 Jun 2024, 12:57

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad fue encontrada en playSMS 1.4.3 y clasificada como problemática. Una función desconocida del archivo /index.php?app=main&inc=feature_phonebook&op=phonebook_list del componente New Phonebook Handler es afectada por esta vulnerabilidad. La manipulación del argumento nombre/correo electrónico conduce a Cross-Site Scripting básicas. Es posible lanzar el ataque de forma remota. El exploit ha sido divulgado al público y puede utilizarse. VDB-269418 es el identificador asignado a esta vulnerabilidad. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera.

22 Jun 2024, 12:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-06-22 12:15

Updated : 2024-09-19 16:50


NVD link : CVE-2024-6251

Mitre link : CVE-2024-6251

CVE.ORG link : CVE-2024-6251


JSON object : View

Products Affected

playsms

  • playsms
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)