~ / search / GHSA-2pmx-6mm6-6v72

GHSA-2pmx-6mm6-6v72

Smarty arbitrary PHP code execution

Source: GitHub Advisory Database (reviewed) High CVE-2014-8350

Packages

EcosystemPackageAffectedFixed in
Packagist smarty/smarty < 3.1.21 3.1.21

Details

As written in the advisory (Markdown source, shown as plain text).

Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.

References

External links from the advisory. They lead to third-party sites.