high8.8Public exploit code
CVE-2017-9080
PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PlaySMS 1.4 - 'sendfromfile.php?Filename' (Authenticated) 'Code Execution (Metasploit)2018-05-08 · remote · php · Verified
Impact
PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Playsms | Playsms | Version 1.4 |