Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2018-18387 — playSMS < = 1.4.2 - Privilege escalation | Kitploit
Tools/GitHubGitHub/theeblind/cve-2018-18387
Privilege EscalationVulnerability AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHubtheeblind/cve-2018-18387

CVE-2018-18387

playSMS < = 1.4.2 - Privilege escalation

View Repository
537 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2018-18387

playSMS < = 1.4.2 - Privilege escalation

TMHC TEAM found a vulnerability that lead to a priviledge escalation through playSMS/web/init.php that can lead to a complete system compromise.

The attacker need to get access on the box where playSMS is installed and be able to edit playSMS related files, and the daemon must be run as root. In the PHP code, references to a daemon were noticed. Research was conducted on the found daemon. The daemon was located in /usr/local/bin and it had associated files in /etc/init.d/.

This daemon is generally run by root, after being tested with a simple whoami command.

The daemon can't be directly modified, yet there is a while loop that runs every second which contains a include init.php. This file exists in /var/www/html/playsms.

Mitigations: Don't run the daemon as root.

The developers were contacted and a fix was released.

Playsms Contacts:

https://playsms.org

https://github.com/antonraharja/playSMS

Download Tool