CVE-2009-1669: Input Validation
The smartyfunctionmath function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. NOTE: some of these details are obtained from third party information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1669?
CVE-2009-1669 is classified as high severity due to its potential to allow arbitrary command execution.
How do I fix CVE-2009-1669?
Fixing CVE-2009-1669 involves upgrading to a version of Smarty that is not vulnerable, specifically a version later than 2.6.22.
What systems are affected by CVE-2009-1669?
CVE-2009-1669 affects Smarty version 2.6.22 and possibly earlier versions.
What kind of attack is possible with CVE-2009-1669?
CVE-2009-1669 allows context-dependent attackers to execute arbitrary commands through shell metacharacters in the equation attribute.
Who is impacted by CVE-2009-1669?
Developers using versions of Smarty 2.6.22 and earlier are at risk from CVE-2009-1669 if they allow untrusted input.