CVE-2017-9080

PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2017-05-19

Last modified

2024-08-05

Weaknesses

CWE-434

Affected products

• Playsms (Playsms)

References

• http://touhidshaikh.com/blog/poc/playsms-v1-4-rce/
• https://www.exploit-db.com/exploits/42003/
• https://www.exploit-db.com/exploits/44599/