webPromedium
Lab 135 — PageCraft — SSTI in CMS Page Editor
hackadvisor
Task: Flask CMS with page editor supporting template variables. Solution: Discovered SSTI in page content via differential analysis (pages render templates, posts don't), exploited via lipsum.__globals__ to achieve RCE and read /root/flag.txt.
$ ls tags/ techniques/
ssti_exploitationjinja2_rce_via_globalsdifferential_content_rendering_analysis
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]PageCraft — SSTI via Twig Template Engine in Post Content— hackadvisor
- [web][Pro]Lab 237 — MailCraft — SSTI in Email Template Preview— hackadvisor
- [web][Pro]Lab 389 — PulseBoard — SSTI in Custom Widget Template Builder— hackadvisor
- [web][Pro]Lab 134 — DocForge — FreeMarker SSTI Sandbox Escape via ?api Built-in— hackadvisor
- [web][Pro]Lab 55 — LinguaPress — SSTI via Multilingual Widget Shortcodes— hackadvisor