CVE-2011-1028 — Improper Input Validation in Smarty

CWE-20 — Improper Input Validation7 documents5 sources
Severity
9.8CRITICALNVD
EPSS
0.5%
top 33.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Smarty3SmartyDebian Smarty3+1 more
Timeline
PublishedNov 20
Latest updateApr 22

Description

The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty_internal_compile_private_special_variable.php file.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶debiandebian/smarty3< smarty3 3.0.8-1 (bookworm)
▶Debiansmarty3/smarty3< 3.0.8-1+3
▶CVEListV5smarty3/smarty33
▶NVDsmarty/smarty3.0.0 — 3.0.7
▶Packagistsmarty/smarty< 3.0.7

Also affects: Debian Linux 10.0, 8.0, 9.0

🔴Vulnerability Details

3
OSV
Smarty3 Arbitrary PHP Code Execution↗2022-04-22
▶
GHSA
Smarty3 Arbitrary PHP Code Execution↗2022-04-22
▶
OSV
CVE-2011-1028: The $smarty↗2019-11-20
▶

💥Exploits & PoCs

2
Exploit-DB
Ipswitch TFTP Server 1.0.0.24 - Directory Traversal↗2011-12-02
▶
Exploit-DB
eZip Wizard 3.0 - Local Stack Buffer Overflow (Metasploit)↗2011-04-25
▶

📋Vendor Advisories

1
Debian
CVE-2011-1028: smarty3 - The $smarty.template variable in Smarty3 allows attackers to possibly execute ar...↗2011
▶