CVE-2017-9080: PlaySMS unrestricted file upload in sendfromfile.php enables RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution with public exploits and very high EPSS, though exploitation requires an authenticated low-privileged account and no KEV listing confirms in-the-wild use.

What it is

PlaySMS 1.4 executes PHP code contained in the name of an uploaded .php file through sendfromfile.php, combining unrestricted file upload with code injection. An authenticated user who can reach that upload path can turn a file upload into remote code execution on the server. The record does not specify which privilege level or role is required beyond the CVSS PR:L rating.

Impact

An attacker gains remote code execution with the privileges of the web server process, compromising confidentiality, integrity and availability of the PlaySMS host. This can lead to full application and potentially host takeover.

Attack surface

Reached over the network via the sendfromfile.php upload functionality; the CVSS vector indicates low privileges are required and no user interaction. No further detail on the exact endpoint parameters is given in the record.

Exploitation

Public exploit code exists in Exploit-DB (42003, 44599), and EPSS is 0.62308 (99.1st percentile), indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is documented in this record.

What to do

• Upgrade PlaySMS to a version later than 1.4 that fixes the sendfromfile.php upload handling.
• If patching is not immediately possible, restrict or disable the sendfromfile.php upload feature and remove upload directories from web execution paths.
• Enforce strict file type and extension validation on all uploads, rejecting .php and other executable extensions.
• Run the PlaySMS web service with least privilege and isolate it so uploaded code cannot reach sensitive files or the host.
• Restrict network access to the PlaySMS administrative and upload interfaces to trusted users.

Detection

• Monitor web logs for POST requests to sendfromfile.php followed by requests to newly uploaded .php files.
• Alert on creation of .php files in upload or web-accessible directories.
• Look for unexpected child processes spawned by the web server (e.g., PHP spawning shells or system utilities).
• Review PlaySMS accounts and upload activity for anomalous or unauthorized file submissions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.