NVD

Id
1027  
Name
CVE-2008-1066  
Description
The modifier.regex_replace.php plugin in Smarty before 2.6.19, as used by Serendipity (S9Y) and other products, allows attackers to call arbitrary PHP functions via templates, related to a "" character in a search string.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2008-02-28  
Modified Date
2012-01-23  
Seq
2008-1066  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
6256 1027 CVE-2008-1066 http://blog.s9y.org/archives/191-Serendipity-1.3-beta1-released.html  View
6257 1027 CVE-2008-1066 SUSE-SR:2008:007  View
6258 1027 CVE-2008-1066 GLSA-201111-04  View
6259 1027 CVE-2008-1066 DSA-1520  View
6260 1027 CVE-2008-1066 http://www.phpinsider.com/smarty-forum/viewtopic.php?p=47652  View
6261 1027 CVE-2008-1066 28105  View
6262 1027 CVE-2008-1066 http://www.smarty.net/misc/NEWS  View
6263 1027 CVE-2008-1066 smarty-modifierregexreplace-security-bypass(41002)  View
6264 1027 CVE-2008-1066 FEDORA-2008-2650  View
6265 1027 CVE-2008-1066 FEDORA-2008-2587  View
6266 1027 CVE-2008-1066 FEDORA-2008-2656  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
50218 JVNDB-2008-005528 S9Y などの製品で使用される Smarty における任意の PHP 関数を呼び出される脆弱性 Serendipity (S9Y) およびその他の製品で使用される Smarty の modifier.regex_replace.php プラグインは、検索文字列内の "" キャラクタに関する処理に不備があるため、任意の PHP 関数を呼び出される脆弱性が存在します。 CVE-2008-1066 31179 CVE-2008-1066 1027 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-005528.html 2008-02-28 2012-12-20 View