Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 2
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Newmediacompany Smarty
cpe:2.3:a:newmediacompany:smarty:*:*:*:*:*:*:*:*
|
— |
4.5.8
|
|
Newmediacompany Smarty
cpe:2.3:a:newmediacompany:smarty:*:*:*:*:*:*:*:*
|
5.0.0
|
5.8.5
|
References 6
https://github.com/smarty-php/smarty/security/advisories/GHSA-3w63-v7pm-cq9x
GitHub Security Advisory (GHSA-3w63-v7pm-cq9x)
https://github.com/smarty-php/smarty/commit/c0fdd4824aca4f67e814b50703cfee1dfde…
NVD
https://github.com/smarty-php/smarty/commit/1cba51cb813563eb61d963c83d28cd59f26…
NVD
https://github.com/smarty-php/smarty/releases/tag/v5.8.5
smarty v5.8.5 Release Notes
https://github.com/smarty-php/smarty/releases/tag/v4.5.8
smarty v4.5.8 Release Notes
https://www.vulncheck.com/advisories/smarty-before-4.5.8-and-5-x-before-5.8.5-p…
VulnCheck Advisory: Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache