CVE-2017-9741

CVE-2017-9741 describes a critical arbitrary PHP code execution vulnerability in ProjectSend r754, specifically within the install/make-config.php component. This flaw allows unauthenticated remote attackers to inject and execute malicious PHP code by manipulating the 'dbprefix' parameter during installation, which then modifies the configuration file. With a CVSS score of 9.8 (Critical), exploitation is trivial due to a network attack vector and low complexity, leading to complete compromise of confidentiality, integrity, and availability. While no public exploits or active exploitation have been observed, and community discussion is minimal, the high severity warrants immediate patching for affected ProjectSend installations.