CVE-2009-1669

Smarty 2.6.22 - Remote Code Execution via Math Function Equation Attribute

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-1669. PoCs published by Nine:Situations:Group.

AI-analyzed exploit summary This exploit leverages a directory traversal and arbitrary file creation vulnerability in Bitweaver's boards_rss.php to achieve remote code execution. It manipulates the 'version' parameter to inject PHP code into arbitrary files, bypassing authentication via user-controlled 'display name' fields.

Description

The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. NOTE: some of these details are obtained from third party information.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Nine:Situations:Group · phpwebappsphp

https://www.exploit-db.com/exploits/8659

View Code ZIP pw:eip

This exploit leverages a directory traversal and arbitrary file creation vulnerability in Bitweaver's boards_rss.php to achieve remote code execution. It manipulates the 'version' parameter to inject PHP code into arbitrary files, bypassing authentication via user-controlled 'display name' fields.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Bitweaver <= 2.6.0

Auth required

Prerequisites: Valid user account with permission to modify 'display name' · Curl extension enabled in PHP

MITRE ATT&CK