CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
Confidence
High
EPSS
Percentile
85.5%
The _expand_quoted_text function in libs/Smarty_Compiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrary PHP code via vectors related to templates and (1) a dollar-sign character, aka “php executed in templates;” and (2) a double quoted literal string, aka a “function injection security hole.” NOTE: each vector affects slightly different SVN revisions.
Vendor | Product | Version | CPE |
---|---|---|---|
smarty | smarty | 2.6.0 | cpe:/a:smarty:smarty:2.6.0:rc3:: |
smarty | smarty | 2.6.5 | cpe:/a:smarty:smarty:2.6.5::: |
smarty | smarty | 2.6.12 | cpe:/a:smarty:smarty:2.6.12::: |
smarty | smarty | 2.0.1 | cpe:/a:smarty:smarty:2.0.1::: |
smarty | smarty | 1.2.2 | cpe:/a:smarty:smarty:1.2.2::: |
smarty | smarty | 2.6.9 | cpe:/a:smarty:smarty:2.6.9::: |
smarty | smarty | 1.5.0 | cpe:/a:smarty:smarty:1.5.0::: |
smarty | smarty | 2.6.10 | cpe:/a:smarty:smarty:2.6.10::: |
smarty | smarty | 2.6.18 | cpe:/a:smarty:smarty:2.6.18::: |
smarty | smarty | 1.3.2 | cpe:/a:smarty:smarty:1.3.2::: |
code.google.com/p/smarty-php/source/detail?r=2784&path=/trunk/libs/Smarty_Compiler.class.php
code.google.com/p/smarty-php/source/detail?r=2797&path=/trunk/libs/Smarty_Compiler.class.php
secunia.com/advisories/32329
securityvulns.ru/Udocument746.html
smarty-php.googlecode.com/svn/trunk/NEWS
www.debian.org/security/2008/dsa-1691
www.openwall.com/lists/oss-security/2008/10/25/2
www.securityfocus.com/bid/31862
bugs.gentoo.org/attachment.cgi?id=169804&action=view
exchange.xforce.ibmcloud.com/vulnerabilities/46031