CVE-2017-9101

PlaySMS 1.4 authenticated RCE Simple method of performing remote code execution through the Phonebook CSV upload issue as described on ExploitDB. Either run a single command: % python3 playsmshell.py --url http://localhost/playsms --password playwithsms -c 'id' Grabbing CSRF token for login...

PT-2017-18703

Name of the Vulnerable Software and Affected Versions PlaySMS version 1.4 Description The issue allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file, specifically in the import.php feature, also known as the Phonebook import feature...