Smarty Template Engine '$smarty.template' PHP Code Injection Vulnerability

Bugtraq ID:	46366
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 09 2011 12:00AM
Updated:	Feb 09 2011 12:00AM
Credit:	jonieske
Vulnerable:	Smarty Template Engine 2.6.9 Smarty Template Engine 2.6.8 Smarty Template Engine 2.6.7 + Gentoo Linux Smarty Template Engine 2.6.6 Smarty Template Engine 2.6.5 Smarty Template Engine 2.6.4 Smarty Template Engine 2.6.3 Smarty Template Engine 3.0.6
Not Vulnerable:	Smarty Template Engine 3.0.7

Smarty Template Engine '$smarty.template' PHP Code Injection Vulnerability

Smarty Template Engine is prone to a remote PHP code-injection vulnerability.

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Versions prior to Smarty Template Engine 3.0.7 are vulnerable.

Smarty Template Engine '$smarty.template' PHP Code Injection Vulnerability

Attackers can exploit this issue via a browser.

The following example input is available:

$smarty.template : '.(include 'hack.php').'.tpl

Smarty Template Engine '$smarty.template' PHP Code Injection Vulnerability

Solution:
Updates are available. Please see the references for more details.

Smarty Template Engine '$smarty.template' PHP Code Injection Vulnerability

References:

• Smarty Changelog (Smarty)
  
• Smarty Homepage (Smarty)