CVEs-PoC/2021/CVE-2021-26120.md

CVE-2021-26120

Description

Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.

POC

Reference

No PoCs from references.

Github

• https://github.com/20142995/sectool
• https://github.com/J1ezds/Vulnerability-Wiki-page
• https://github.com/Threekiii/Awesome-POC
• https://github.com/Threekiii/Vulhub-Reproduce
• https://github.com/XiaomingX/awesome-poc-for-red-team
• https://github.com/g1san/Agents-for-Vulnerable-Dockers-and-related-Benchmarks