CVE-2020-8644

What is PlaySMS?

PlaySMS is an open-source SMS gateway management platform, built on PHP and used by organizations to send and manage bulk SMS messaging campaigns through connected SMS modems or provider APIs. Because it processes user-supplied content — message templates, sender names, campaign text — through a templating engine to generate outbound messages, it's a natural target for template-injection bugs if that user input isn't properly isolated from the template engine's execution context.

Overview

CVE-2020-8644 is a server-side template injection vulnerability (CWE-94, improper control of code generation) in PlaySMS. A feature that renders a customizable message "banner" or template passes attacker-influenced input into the underlying template engine without adequately sandboxing it, allowing an attacker to inject template syntax that executes arbitrary PHP code on the server rather than simply rendering as text (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical).

Technical Details

Server-side template injection occurs when user input is concatenated into a template string that the engine then compiles and executes, rather than being passed purely as data to be substituted into a fixed template. In PlaySMS's case, this lets an attacker embed template-engine syntax into a message field that, once processed by the vulnerable rendering path, runs as code on the server — a well-known bug class also seen in other PHP applications using unsandboxed template engines like Smarty or Twig without disabling dangerous functions.

Discovery

Publicly tracked via NVD; PlaySMS has had a history of authentication and injection-class vulnerabilities disclosed by independent researchers over the years, consistent with a smaller open-source project with a narrower security review process than larger commercial platforms.

Exploitation Context

CISA added this CVE to KEV in November 2021 based on confirmed exploitation. PlaySMS installations are often run by smaller organizations and resellers managing SMS campaigns, a population less likely to have dedicated security monitoring, making genuine incident visibility into specific campaigns limited in public reporting.

Remediation

1. Upgrade to a patched PlaySMS release that sandboxes or removes the vulnerable template-rendering path.
2. Restrict access to the PlaySMS admin interface to trusted networks; it should not be directly internet-facing.
3. Audit any custom message templates or banners for injected template syntax if the instance was exposed prior to patching.
4. Review outbound SMS logs for unexpected message content or volume that could indicate the platform was used to send unauthorized messages following compromise.