CVE-2018-18387

playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse...

Privilege escalation

playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse...

CVE-2018-18387

playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse...

CVE-2018-18387

PlaySMS prior to or at version 1.4.2 is affected by a Privilege Escalation vulnerability described as abuse of the daemon process. Connected sources corroborate that PlaySMS is a web-based SMS platform and that the vulnerability is present in PlaySMS 1.4.2 and earlier. The exact root-cause detail...

PlaySMS 1.4 - sendfromfile.php?Filename Authenticated Code Execution Exploit

This Metasploit module exploits a code injection vulnerability within an authenticated file upload feature in PlaySMS version 1.4. This issue is caused by improper file name handling in sendfromfile.php file. Authenticated Users can upload a file and rename the file with a malicious payload. This...

PlaySMS 1.4 - import.php Authenticated CSV File Upload Code Execution Exploit

This Metasploit module exploits an authenticated file upload remote code execution vulnerability in PlaySMS version 1.4. This issue is caused by improper file contents handling in import.php aka the Phonebook import feature. Authenticated Users can upload a CSV file containing a malicious payload...

PlaySMS 1.4 - 'sendfromfile.php?Filename' (Authenticated) 'Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PlaySMS sendfromfile.php Authenticated "Filename" Field Code Execution', 'Description' = %q This module exploits a code injection vulnerability...

PlaySMS - 'import.php' (Authenticated) CSV File Upload Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PlaySMS import.php Authenticated CSV File Upload Code Execution', 'Description' = %q This module exploits an authenticated file upload remote cod...

PlaySMS import.php Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PlaySMS import.php Authenticated CSV File Upload Code Execution', 'Description' = %q This module exploits an authenticated file upload remote cod...

PlaySMS sendfromfile.php Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PlaySMS sendfromfile.php Authenticated "Filename" Field Code Execution', 'Description' = %q This module exploits a code injection vulnerability...

PlaySMS Remote Code Execution Vulnerability

PlaySMS is a web-based SMS platform. The platform supports connectivity to SMS gateways, personal messaging systems, and corporate group communication tools. A remote code execution vulnerability exists in the sendfromfile.php file in PlaySMS version 1.4. A remote attacker can exploit this...

PlaySMS Remote Code Execution Vulnerability (CNVD-2017-08174)

PlaySMS is a web-based SMS platform. The platform supports connectivity to SMS gateways, personal messaging systems, and corporate group communication tools. A remote code execution vulnerability exists in the import.php file a.k.a. phonebook import function in PlaySMS version 1.4. A remote...

PlaySMs Remote Code Execution Vulnerability (CNVD-2017-10344)

PlaySMS is an open source WEB SMS platform. A remote code execution vulnerability exists in PlaySms. The vulnerability stems from the address book calling a function in import.php. An attacker can exploit the vulnerability to execute malicious code...

Remote code execution

import.php aka the Phonebook import feature in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file...

CVE-2017-9101

import.php aka the Phonebook import feature in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file...

CVE-2017-9101

import.php aka the Phonebook import feature in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file...

CVE-2017-9101

CVE-2017-9101 affects PlaySMS 1.4 where import.php (Phonebook import) allows remote code execution. The vulnerability arises from improper handling of file contents during a CSV upload, enabling PHP code execution via payloads contained in the uploaded file name or User-Agent header. Public refer...

CVE-2017-9101

import.php aka the Phonebook import feature in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file...

PlaySMS 1.4 - 'import.php' Remote Code Execution

Exploit Title: PlaySMS 1.4 Remote Code Execution using Phonebook import Function in import.php Date: 21-05-2017 Software Link: https://playsms.org/download/ Version: 1.4 Exploit Author: Touhid M.Shaikh Contact: http://twitter.com/touhidshaikh22 Website: http://touhidshaikh.com/ Category: webapps ...

PlaySMS import.php Authenticated CSV File Upload Code Execution

This module exploits an authenticated file upload remote code excution vulnerability in PlaySMS Version 1.4. This issue is caused by improper file contents handling in import.php aka the Phonebook import feature. Authenticated Users can upload a CSV file containing a malicious payload via vectors...