BID:34918

Smarty Template Engine 'function.math.php' Security Bypass Vulnerability

Info

Smarty Template Engine 'function.math.php' Security Bypass Vulnerability

Bugtraq ID:	34918
Class:	Input Validation Error
CVE:	CVE-2009-1669
Remote:	Yes
Local:	No
Published:	May 12 2009 12:00AM
Updated:	May 07 2015 05:11PM
Credit:	Nine:Situations:Group::bookoo &amp;amp;amp;amp;amp;amp;lt;br&amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;lt;br&amp;amp;amp;amp;amp;amp;amp;amp;gt;
Vulnerable:	Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Smarty Template Engine 2.6.22 Smarty Template Engine 2.6.19 Smarty Template Engine 2.6.18 Smarty Template Engine 2.6.17 Smarty Template Engine 2.6.16 Smarty Template Engine 2.6.15 Smarty Template Engine 2.6.14 Smarty Template Engine 2.6.13 Smarty Template Engine 2.6.12 Smarty Template Engine 2.6.11 Smarty Template Engine 2.6.10 Smarty Template Engine 2.6.9 Smarty Template Engine 2.6.8 Smarty Template Engine 2.6.7 + Gentoo Linux Smarty Template Engine 2.6.6 Smarty Template Engine 2.6.5 Smarty Template Engine 2.6.4 Smarty Template Engine 2.6.3 Smarty Template Engine 2.6.2 Smarty Template Engine 2.6.1 Smarty Template Engine 2.6 Smarty Template Engine 2.6.20-1 Pardus Linux 2008 0 Mahara Mahara 1.1.7 Mahara Mahara 1.1.6 Mahara Mahara 1.1.5 Mahara Mahara 1.1.4 Mahara Mahara 1.1.3 Mahara Mahara 1.1.2 Mahara Mahara 1.1.1 Mahara Mahara 1.0.13 Mahara Mahara 1.0.12 Mahara Mahara 1.0.11 Mahara Mahara 1.0.10 Mahara Mahara 1.0.9 Mahara Mahara 1.0.8 Mahara Mahara 1.0.6 Mahara Mahara 1.0.5 Mahara Mahara 1.0.4 Mahara Mahara 1.0.3 Mahara Mahara 1.0.2 Mahara Mahara 1.0.1 Mahara Mahara 1.0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0

Not Vulnerable:	Smarty Template Engine 2.6.23 Mahara Mahara 1.1.8 Mahara Mahara 1.0.14

Discussion

Smarty Template Engine 'function.math.php' Security Bypass Vulnerability

Smarty Template Engine is prone to a security-bypass vulnerability because it fails to adequately sanitize user-supplied input.

Attackers may exploit the issue to bypass certain security restrictions and execute arbitrary PHP code in the context of the application.

Smarty Template Engine 2.6.22 for Windows is vulnerable; other versions may also be affected.

Exploit / POC

Smarty Template Engine 'function.math.php' Security Bypass Vulnerability

Attackers can exploit this issue via a browser.

The following exploit code is available:

/data/vulnerabilities/exploits/34918.php

Solution / Fix

Smarty Template Engine 'function.math.php' Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Debian Linux 5.0 ia-64