The vendor has reported two vulnerabilities in PlaySMS, allowing malicious people to conduct SQL injection attacks and execute arbitrary system commands.

1) Certain input isn't properly verified before it is used in a SQL query. This can be exploited to manipulate SQL queries.

2) Certain input isn't properly verified before it is used to execute external commands. This can be exploited to execute arbitrary commands.

This affects versions prior to 0.7.

Solution
According to the vendor this has been fixed in version 0.7:
Further details available in Customer Area

Provided and/or discovered by
Reported by the vendor.

Original Advisory
http://playsms.sourceforge.net/web/

Deep Links
Links available in Customer Area