CVE-2018-18387

This exploit abuses a privilege escalation vulnerability in playSMS <= 1.4.2 by injecting a reverse shell into the init.php file, which is included by a root-run daemon. The attacker must have write access to the playSMS directory and the daemon must be running as root.