Lab 55 — LinguaPress — SSTI via Multilingual Widget Shortcodes

hackadvisor

Task: PHP/Twig multilingual CMS where shortcode content is rendered through Twig template engine with a custom input filter blocking quotes, dangerous filters, and functions. Solution: Bypass filter using %c in post title with |format(ASCII) to construct strings at runtime, then achieve RCE via |sort callback injection into PHP's usort().