Description

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-31T21:17:50.923Z",
  "pubdate": "2026-08-31T21:17:50.923Z",
  "executiveSummary": "A critical security vulnerability has been identified in Smart Marketing SMS and Newsletters Forms, specifically affecting versions 5.1.24 and prior. This vulnerability is classified as an unauthenticated SQL Injection (SQLi) within the application's form submission mechanisms. Because the flaw can be exploited without any prior authentication, remote threat actors can easily target exposed instances over the network. The risk implication of this vulnerability is exceptionally high, as successful exploitation grants attackers unauthorized access to the underlying database. Depending on database configurations and user privileges, an attacker can read sensitive user data, modify or delete database records, or potentially execute administrative commands. This vulnerability compromises the confidentiality, integrity, and availability of the application data, making it a priority for remediation.\nFurthermore, the exposure of newsletter and SMS form endpoints to the public internet exacerbates the risk, as these components are designed to accept input from untrusted sources. Threat actors can automate the discovery and exploitation of these forms, potentially leading to widespread data harvesting, authentication bypass, or application takeover in affected environments where Smart Marketing SMS and Newsletters Forms <= 5.1.24 is deployed.",
  "technicalDetails": "The vulnerability exists within the form handling logic of Smart Marketing SMS and Newsletters Forms in versions up to and including 5.1.24. When processing user submissions from newsletter or SMS signup forms, the application fails to properly sanitize, validate, or parameterize input parameters before utilizing them in SQL queries. This architectural flaw allows an unauthenticated, remote attacker to manipulate database queries by injecting crafted SQL payloads into input fields such as names, phone numbers, or email addresses.\nThe underlying root cause is the unsafe concatenation of user-supplied data directly into SQL query strings executed by the backend database. In a standard operation, the application inserts subscriber details into the database. However, if an input field contains SQL control characters (such as single quotes or semicolon delimiters), the SQL interpreter parses these characters as structural commands rather than literal values.\nThe attack flow begins with the reconnaissance phase, where an attacker scans for public-facing forms rendered by the vulnerable versions of Smart Marketing SMS and Newsletters Forms. Once identified, the attacker crafts an HTTP POST request containing malicious SQL constructs. Depending on the backend database structure and configuration, the attacker can leverage multiple SQL injection methodologies: 1. UNION-Based SQL Injection: The attacker injects a SELECT statement that is joined with the original query, allowing direct exfiltration of data from other database tables, such as administrator credentials, session tokens, or personal identifiable information (PII). 2. Boolean-Based Blind SQL Injection: By injecting conditional SQL statements that resolve to true or false, the attacker can systematically infer database contents based on differences in application responses. 3. Time-Based Blind SQL Injection: In scenarios where application responses do not differ, the attacker injects sleep commands (e.g., SLEEP() in MySQL) to force the database to delay its response. By measuring the response latency, the attacker can reconstruct database tables character by character.\nIf the database service runs with elevated system privileges, the attacker could also read sensitive local files using functions like LOAD_FILE() or attempt to write web shells to the web root via INTO OUTFILE clauses, escalating the SQL injection to a Remote Code Execution (RCE) state. No authentication or special privileges are required to execute this attack. This severe exposure underscores the danger of trust boundaries within web applications where external data directly influences backend query generation without strict schema validation."
}