CVE-2008-1066: Input Validation
The modifier.regexreplace.php plugin in Smarty before 2.6.19, as used by Serendipity (S9Y) and other products, allows attackers to call arbitrary PHP functions via templates, related to a '\0' character in a search string.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1066?
CVE-2008-1066 has been classified as a high severity vulnerability due to its potential for code execution.
What types of applications are affected by CVE-2008-1066?
CVE-2008-1066 affects applications using the Smarty template engine version prior to 2.6.19, including those like Serendipity.
How do I fix CVE-2008-1066?
To fix CVE-2008-1066, upgrade Smarty to version 2.6.19 or later.
What exploitation methods exist for CVE-2008-1066?
Attackers can exploit CVE-2008-1066 by injecting a '\0' character into a search string, allowing arbitrary PHP function calls.
How can I mitigate the risk of CVE-2008-1066?
To mitigate the risk of CVE-2008-1066, ensure that all templates are securely coded and sanitize user inputs to prevent injection.