webPromedium

QuickBite — SSTI via Registration Name Field

hackadvisor

Task: Flask food delivery app with user registration; first_name field passed to Jinja2 render_template_string() unsandboxed on profile welcome banner. Solution: Registered user with {{lipsum.__globals__['os'].popen('cat /root/flag.txt').read()}} as first_name, visited /profile to trigger SSTI→RCE.

$ ls tags/ techniques/
flaskrcesstipythonjinja2template_injectiondecoy_flagfood_deliveryhoneypot_flagregistration
ssti_jinja2render_template_string_abusedecoy_flag_recognitionrce_via_lipsum_globals_os_popenuser_registration_injection
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups