CVE-2008-4810

The _expand_quoted_text function in libs/Smarty_Compiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrary PHP code via…

published October 31, 2008

CVSS
—
EPSS
2%
Percentile
82.2
In the wild
Unconfirmed
What it is

The _expand_quoted_text function in libs/Smarty_Compiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrary PHP code via vectors related to templates and (1) a dollar-sign character, aka "php executed in templates;" and (2) a double quoted literal string, aka a "function injection security hole." NOTE: each vector affects slightly different SVN revisions.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02187 · 82.2th percentile
Published
2008-10-31T17:18Z
EPSS history
Timeline
  • 31 OCT 17:18Z
    The _expand_quoted_text function in libs/Smarty_Compiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrary PHP code via…
    cvelistv5