# Urgent: Server side template injection via Smarty template allows for RCE

Smarty template injection in Unikrn profile name fields executed {php} tags in invitation emails, letting an attacker read /etc/passwd and potentially gain RCE.

- Payout: hidden
- Severity: critical
- Program: Unikrn
- Found by: yaworsk
- Disclosed: 2017-08-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/164224
- Library page: https://bugbountylibrary.com/r/h1%3A164224
- Tags: area:web domain:web impact:data-leak impact:rce kind:bounty platform:hackerone sev:critical tech:php technique:source-review vuln:info-disclosure vuln:rce vuln:ssti

**Target:** Smarty templating in invitation email generation
**Root cause:** User-controlled profile fields (firstname, lastname, nickname) are rendered into Smarty templates without sanitization, and Smarty's {php} tags are enabled, so injected PHP executes server-side.
**Steps:**
1. Edit profile and set firstname/lastname/username to `{7*7}`; invitation email shows template error confirming injection.
2. Confirm version with `{$smarty.version}`.
3. Test PHP execution with `{php}print "Hello"{/php}`.
4. Set payload `{php}$s = file_get_contents('/etc/passwd',NULL, NULL, 0, 100); var_dump($s);{/php}` in name fields.
5. Invite a friend via another email and view the received email to see /etc/passwd contents dumped.
**How found:** Started with a simple arithmetic Smarty payload {7*7} in name fields, observed a template error in the invitation email, confirming server-side template evaluation, then escalated to version disclosure and {php} tag execution.
**Exploitation:** Attacker stores a Smarty {php} payload in profile name fields, then triggers an invitation email to a controlled address; the server renders the template and executes the embedded PHP, returning file contents in the email body.
**Escalation:** Attacker notes the same primitive could likely be extended to spawn a shell on the server for full RCE.
**Insight:** Profile fields that later feed into transactional email templates are a common SSTI sink; probe with arithmetic payloads like {7*7} and check rendered emails, then test engine-specific tags such as Smarty {php} or {$smarty.version}.