QuickBite — SSTI via Registration Name Field

hackadvisor

Task: Flask food delivery app with user registration; first_name field passed to Jinja2 render_template_string() unsandboxed on profile welcome banner. Solution: Registered user with {{lipsum.__globals__['os'].popen('cat /root/flag.txt').read()}} as first_name, visited /profile to trigger SSTI→RCE.