CVE:CVE-2011-1028
CNNVD:CNNVD-201911-1181
Smarty是一套基于PHP的网页模板系统。该系统支持将HTML/CSS等与应用程序逻辑分离。
Smarty3中的$smarty.template变量存在安全漏洞。攻击者可借助sysplugins/smarty_internal_compile_private_special_variable.php文件利用该漏洞执行任意PHP代码。
solution:Upgrade smarty smarty to a higher version than 3.0.7,and avoid the version [3.0.0,3.0.7); Upgrade debian debian_linux to a higher version than 8.0,9.0,10.0,and avoid the version 8.0,9.0,10.0