cve/2017/CVE-2017-9080.md

CVE-2017-9080

Description

PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection.

POC

Reference

• http://touhidshaikh.com/blog/poc/playsms-v1-4-rce/
• https://www.exploit-db.com/exploits/42003/
• https://www.exploit-db.com/exploits/44599/

Github

• https://github.com/ARPSyndicate/cvemon