CVE-2009-1669 EXPLOIT
10.0
HIGH · CVSS 2.0 · EPSS 14.1% (pctl 96)
Patch early
A public exploit exists.
Description
The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. NOTE: some of these details are obtained from third party information.
Scoring
| CVSS | 10.0 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| EPSS | 14.12% — more likely to be exploited than 96% of all CVEs |
| Weakness | CWE-20 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2009-05-18 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| smarty | smarty |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Bitweaver 2.6 - 'saveFeed()' Remote Code Execution | 2009-05-12 |
References
- http://osvdb.org/54380
- http://secunia.com/advisories/35072
- http://secunia.com/advisories/35219
- http://www.securityfocus.com/bid/34918
- http://www.ubuntu.com/usn/usn-791-3
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50457
- https://www.exploit-db.com/exploits/8659
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01274.html
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01283.html
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01287.html
- http://osvdb.org/54380
- http://secunia.com/advisories/35072
- http://secunia.com/advisories/35219
- http://www.securityfocus.com/bid/34918
- http://www.ubuntu.com/usn/usn-791-3
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50457
- https://www.exploit-db.com/exploits/8659
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01274.html
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01283.html
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01287.html
→ the Explorer · watch your stack · NVD