webPromedium

MailPulse

hackadvisor

Task: MailPulse email marketing platform with Smarty template engine editor and preview endpoint vulnerable to SSTI. Solution: Inject {system(\"cat /root/flag.txt\")} via template preview API to achieve RCE and read the flag, bypassing {fetch} tag path restrictions.

$ ls tags/ techniques/
rcefile_readphpsstinginxtemplate_injectiondecoy_flagalpine_linuxemail_platformsmarty
decoy_flag_recognitionssti_smarty_system_tagrce_via_template_enginesmarty_math_confirmationfetch_tag_bypass_via_system
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups