CVE-2017-9080

High

Published: 19/05/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

PlaySMS version 1.4 allows remote code execution due to the execution of PHP code in the name of an uploaded .php file. The issue arises from a combination of unrestricted file upload and code injection.

Risk Assessment

The organization may be exposed to remote execution of malicious code, potentially leading to system compromise or data leakage.

Recommendation

It is recommended to upgrade to the latest version of PlaySMS and implement strict controls on file uploads to prevent code injection.

Other vulnerabilities in PlaySMS 1.4

CVE-2017-9101Critical
In PlaySMS 1.4, the import feature (import.php) allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.

Original NVD description (English source)

PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection.