CVE-2008-1066

Smarty < 2.6.18 - Arbitrary PHP Function Execution via Regex Replace Modifier

Title source: llm
STIX 2.1

Description

The modifier.regex_replace.php plugin in Smarty before 2.6.19, as used by Serendipity (S9Y) and other products, allows attackers to call arbitrary PHP functions via templates, related to a '\0' character in a search string.

References (17)

Core 17
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29398
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29241
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2008/dsa-1520
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201111-04.xml
Various Sources x_refsource_confirm
http://www.smarty.net/misc/NEWS
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29405
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29392
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29839
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/41002
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/28105
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29562

Scores

EPSS 0.0195
EPSS Percentile 77.9%

Details

CWE
CWE-20
Status published
Products (1)
smarty/smarty < 2.6.18
Published Feb 28, 2008
Tracked Since Feb 18, 2026