CVE-2017-9101

Related Files

PlaySMS import.php Code Execution

Posted May 7, 2018

Authored by Touhid M.Shaikh | Site metasploit.com

This Metasploit module exploits an authenticated file upload remote code execution vulnerability in PlaySMS version 1.4. This issue is caused by improper file contents handling in import.php (aka the Phonebook import feature). Authenticated Users can upload a CSV file containing a malicious payload via vectors involving the User-Agent HTTP header and PHP code in the User-Agent. This Metasploit module was tested against PlaySMS 1.4 on VulnHub's Dina 1.0 machine and Windows 7.

tags | exploit, remote, web, php, code execution, file upload

systems | windows

advisories | CVE-2017-9101

SHA-256 | fd1838461438181db5479d38d1d1a6bb70ccdcb0e64b5040c592f5b4d3e3b3c7

Download | Favorite | View