Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.
References
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2014-11-03 16:55
Updated : 2017-09-08 01:29
NVD link : CVE-2014-8350
Mitre link : CVE-2014-8350
CVE.ORG link : CVE-2014-8350
JSON object : View
Products Affected
smarty
- smarty
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')