WinSMS Insecure File Permissions Privilege Escalation Vulnerability

WinSMS lets you send bulk SMS text messages via the internet, desktop software or API.

A local privilege escalation vulnerability has been identified in WinSMS due to weak folder permissions.

Affected Versions:
WinSMS version 3.43 and earlier

A local attacker can replace WinSMS files with malicious ones to execute code in the context of the user running this application. WinSMS is typically configured as a startup program which makes this particularly easy to take leverage.

Customers are advised to contact WinSMS to fix this vulnerability.