CVE-2017-9101

EPSS 76.7%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Popular PoC on GitHub (14 stars) — exploitation code widely available.

CVSS —EPSS 76.7%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

21 May 2017Metasploit module available

21 May 2017Public PoC

21 May 2017Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.

Affected products

n/a · n/a

public PoCs found — 5

githubgithub.com/jasperla/CVE-2017-9101★ 14 cve_referencewww.exploit-db.com/exploits/42044/unverified cve_referencewww.exploit-db.com/exploits/44598/unverified exploitdbwww.exploit-db.com/exploits/44598unverified exploitdbwww.exploit-db.com/exploits/42044unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://www.exploit-db.com/exploits/42044/https://www.exploit-db.com/exploits/44598/