Code Execution via SSTI (PHP Smarty)
Invicti identified a code execution which occurs when using an unintentional expression in template engine instead of string literals.
Even though Invicti believes there is a code execution in here, it could not confirm it. There can be numerous reasons for Invicti not being able to confirm it. We strongly recommend you investigate the issue manually to ensure it is a remote code execution and needs to be addressed.
This vulnerability is not difficult to leverage. There are vast resources available for template engines. Successful exploitation requires knowledge of the programming language and syntax of the template engine. Minimal attack skill is enough to exploit vulnerabilities like this one.