cve/2017/CVE-2017-9101.md

CVE-2017-9101

Description

import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.

POC

Reference

• https://www.exploit-db.com/exploits/42044/
• https://www.exploit-db.com/exploits/44598/

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/jasperla/CVE-2017-9101