Lab 243 — VendorNest — SSTI in Product Descriptions via Blade Template Engine

hackadvisor

Task: Multi-vendor marketplace (PHP/Blade) where sellers can create products with rich descriptions rendered through a Blade template engine. Solution: Injected @php directive into product description to achieve SSTI → RCE, bypassed decoy flags, read /root/flag.txt.