Executive brief
Drupal Gammu SMS Daemon is a module that allows Drupal sites to send and receive SMS messages by integrating with the Gammu SMS service. When configured to use Gammu CLI binaries, the module fails to properly sanitize user-supplied phone numbers and message text before passing them to shell commands, allowing authenticated attackers to inject and execute arbitrary operating system commands on the server. This could lead to full server compromise, data theft, or ransomware deployment.
Technical details
The vulnerability is an OS command injection (CWE-78) in the GammuSendSMS::sendSms() method. The application constructs shell commands that include user-controlled input (destination phone number and message body) without proper escaping when the Gammu CLI mode is enabled. While the message body has minimal filtering (double-quote conversion), the phone number field is passed directly to the shell unescaped, allowing trivial command termination and chaining (e.g., "; malicious_command"). The message body is also exploitable via inline execution operators like backticks or $() syntax. The vulnerability is reachable through both the web UI (requires "administer gammu" permission) and REST API endpoint (requires API token). All published versions up to 8.x-1.3 are believed vulnerable. The vendor was contacted on 2026-05-17 but did not acknowledge the risk; as of the disclosure date, no patch has been released.
Affected products
- Drupal Gammu SMS Daemon ≤ 8.x-1.3
Timeline
- 2026-09-02: disclosed
- 2026-05-17: other: Vulnerability reported to maintainer through coordinated disclosure