Lab 225 — MailPulse — SSTI in Campaign Template Preview

hackadvisor

Task: MailPulse email marketing platform (Flask/Jinja2) with campaign template preview endpoint that passes user input to render_template_string() without sandboxing. Solution: Inject {{lipsum.__globals__['os'].popen('cat /root/flag.txt').read()}} via body_html field in POST /campaigns/0/preview to achieve RCE and read the flag.