CVE-2017-9101

60Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 77%

from disclosure to weapon0 days

Published on NVDMay 21

1st PoCMay 21

metasploitMay 21

exploitation probability

77%top 1% of all CVEs

observed exploitation

nono source reports it

5 public exploit(s)

import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.

Affected products

n/a · n/a

public PoCs found — 5✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/44598 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/42044 githubgithub.com/jasperla/CVE-2017-9101★ 14 cve_referencewww.exploit-db.com/exploits/42044/unverified cve_referencewww.exploit-db.com/exploits/44598/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://www.exploit-db.com/exploits/42044/https://www.exploit-db.com/exploits/44598/