PT-2017-18691 · Playsms · Playsms

Darks3Curity + 1 · Publicado 2017-05-19 · Atualizado 2019-03-15 · CVE-2017-9080

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PlaySMS version 1.4

Description The issue allows remote code execution due to the execution of PHP code in the name of an uploaded .php file. This is caused by a combination of Unrestricted File Upload and Code Injection in the sendfromfile.php file.

Recommendations For PlaySMS version 1.4, consider restricting the upload of .php files and validating the file types and contents to prevent code injection. As a temporary workaround, restrict access to the sendfromfile.php file to minimize the risk of exploitation.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2017-9080

Produtos afetados

Playsms

Referências · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/playsms_filename_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/44599 · Exploit
• 🔥 https://exploit-db.com/exploits/42003 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-9080 · Nota de Segurança
• http://touhidshaikh.com/blog/poc/playsms-v1-4-rce · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9080 · Nota
• https://osv.dev/vulnerability/CVE-2017-9080 · Aviso do Fabricante