PlaySMS is "a full-featured SMS gateway application that features sending of single or broadcast SMSes, the ability to receive and forward SMSes, an SMS board, an SMS polling system, SMS customs for handling incoming SMSes and forwarding them to custom applications, and SMS commands for saving/retrieving information to/from a server and executing server-side shell scripts".
An SQL Injection vulnerability in the product allows remote attackers to inject arbitrary SQL statements via the cookie mechanism used by the product.
If you look at the way the function works, the cookie information is received as is. This is true only if the "magic_quotes_gpc" setting is set to "Off" (NOTE: This is discouraged by the author of the program in the INSTALL file).
In the case where "Off" is set the following Perl script will illustrate how it can access the fr_left.php script without having provided any username or password.
The author of the program has addressed the vulnerability by including code that will filter out any incoming malicious code, whenever the magic_quotes_gpc is set to "Off". In addition the author took care of those cases where Microsoft SQL Server is used as the backend and that normal filtering is not enough.
Please note that addslashes will NOT work with Microsoft SQL. Since Microsoft SQL does not use he backslash character as an escape mechanism. Just double your quotes instead. Or use this: