CVE-2017-1000480

Vulnerability

The vulnerability resides in the Smarty template engine for PHP, affecting versions 3 before 3.1.32. The flaw occurs when the fetch() or display() functions are called with custom resources, and the template name is not sanitized, allowing injection of arbitrary PHP code [1].

Exploitation

An attacker must be able to control the template name parameter passed to the fetch() or display() methods of a custom resource. By providing a specially crafted string, the attacker can inject PHP code that the engine will execute [1]. No authentication is required if the application exposes these functions to user input.

Impact

Successful exploitation leads to arbitrary PHP code execution on the server. This can result in full compromise of the application and server, including data disclosure, modification, or destruction, and potential further lateral movement within the network [1].

Mitigation

The vulnerability is fixed in Smarty version 3.1.32, released in 2017. Users should upgrade to Smarty 3.1.32 or later [1][2]. No workarounds are disclosed in the available references; upgrading is the recommended mitigation.