PT-2017-18691 · Playsms · Playsms

Darks3Curity + 1 · Published 2017-05-19 · Updated 2019-03-15 · CVE-2017-9080

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PlaySMS version 1.4

Description The issue allows remote code execution due to the execution of PHP code in the name of an uploaded .php file. This is caused by a combination of Unrestricted File Upload and Code Injection in the sendfromfile.php file.

Recommendations For PlaySMS version 1.4, consider restricting the upload of .php files and validating the file types and contents to prevent code injection. As a temporary workaround, restrict access to the sendfromfile.php file to minimize the risk of exploitation.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2017-9080

Affected Products

Playsms

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/playsms_filename_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/44599 · Exploit
• 🔥 https://exploit-db.com/exploits/42003 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-9080 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9080 · Vendor Advisory
• http://touhidshaikh.com/blog/poc/playsms-v1-4-rce · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9080 · Note