$ cat writeup.md…
$ cat writeup.md…
hackadvisor
Task: email marketing platform (MailCraft) with server-side Jinja2 template preview — SSTI in preview endpoint. Solution: inject {{lipsum.__globals__['os'].popen('env').read()}} via POST /api/templates/1/preview to achieve RCE and read FLAG environment variable.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar