CVE-2007-2326

Name	CVE-2007-2326
Description	Multiple PHP remote file inclusion vulnerabilities in HYIP Manager Pro allow remote attackers to execute arbitrary PHP code via a URL in the plugin_file parameter to (1) Smarty.class.php and (2) Smarty_Compiler.class.php in inc/libs/; (3) core.display_debug_console.php, (4) core.load_plugins.php, (5) core.load_resource_plugin.php, (6) core.process_cached_inserts.php, (7) core.process_compiled_include.php, and (8) core.read_cache_file.php in inc/libs/core/; and other unspecified files. NOTE: (1) and (2) might be incorrectly reported vectors in Smarty.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	488523, 488525, 488527

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
gallery2	source	(unstable)	2.2.5-2	unimportant	488527
moodle	source	(unstable)	1.8.2-2	unimportant	488525
smarty	source	(unstable)	(unfixed)	unimportant	488523

Notes

this is a non-issue
to exploit this, the smarty files need to be installed in a http daemon accessible directory
(should be the case for embedded copies), however
additionally this relies on register_globals being switched on.