CVE-2017-9101
CriticalSummary
In PlaySMS 1.4, the import feature (import.php) allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.
Risk Assessment
This vulnerability may lead to remote code execution, posing a serious threat to the security of the system and user data.
Recommendation
It is recommended to upgrade to the latest version of PlaySMS and to monitor and filter HTTP headers to minimize risk.
Other vulnerabilities in PlaySMS 1.4
See all- CVE-2017-9080High
PlaySMS version 1.4 allows remote code execution due to the execution of PHP code in the name of an uploaded .php file. The issue arises from a combination of unrestricted file upload and code injection.
- CVE-2020-8644CriticalActively exploited
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
Original NVD description (English source)
import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS