CVE-2017-9101: PlaySMS Phonebook import allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-accessible remote code execution with public exploits and very high EPSS probability makes this an urgent patching priority.

What it is

PlaySMS 1.4's import.php Phonebook import feature permits remote code execution through the User-Agent HTTP header and PHP code embedded in a file name. The flaw is an unrestricted file upload (CWE-434) that lets an attacker place and execute PHP code on the server. Because it is network-reachable with no privileges or user interaction required, it is a severe pre-authentication RCE risk.

Impact

An attacker can execute arbitrary code on the PlaySMS server, leading to full compromise of confidentiality, integrity and availability. This can result in web shell deployment, data theft, or use of the host as a pivot point.

Attack surface

Reached over the network via HTTP against import.php in PlaySMS 1.4; the CVSS vector shows no authentication (PR:N) and no user interaction (UI:N). The description indicates the User-Agent header and a crafted file name are the delivery vectors.

Exploitation

Public exploit code exists (Exploit-DB 42044 and 44598), and EPSS is very high at 0.76742 (99.5th percentile), indicating likely exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild campaign is documented in this record.

What to do

• Upgrade PlaySMS to a version later than 1.4 that fixes the import.php upload handling; if no fixed release is available, remove or disable the Phonebook import feature.
• Restrict network access to the PlaySMS web interface and import.php to trusted management networks only.
• Enforce server-side upload validation: reject PHP content in uploaded files, sanitize file names, and store uploads outside the web root.
• Run the web server with least privilege and disable PHP execution in upload directories.
• Monitor and block requests with suspicious User-Agent values targeting import.php.

Detection

• Inspect web server logs for POST requests to import.php with unusual User-Agent headers or multipart uploads containing PHP code.
• Monitor the upload directory and web root for newly created .php files or files with PHP content in their names.
• Alert on unexpected child processes spawned by the web server user (e.g., shell, wget, curl) that may indicate post-exploitation.
• Use file integrity monitoring on PlaySMS application files and upload directories to detect unauthorized changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.