CVE-2017-9101

Critical

Published: 21/05/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In PlaySMS 1.4, the import feature (import.php) allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.

Risk Assessment

This vulnerability may lead to remote code execution, posing a serious threat to the security of the system and user data.

Recommendation

It is recommended to upgrade to the latest version of PlaySMS and to monitor and filter HTTP headers to minimize risk.

Original NVD description (English source)

import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.