webPromedium
Lab 404 — MindVault — RCE via eval() in Search Filter Expressions
hackadvisor
Task: MindVault knowledge platform exposes a search 'Filter Expression' field that is server-side eval()'d as raw Python with no blacklist and no sandbox. Solution: use the test=1 API oracle to confirm eval (7*7=49), then __import__('os').popen('id') runs as root and open('/root/flag.txt').read() returns the flag; a decoy flag and prompt-injection text in HTML are ignored.
$ ls tags/ techniques/
python_eval_injectiondecoy_flag_recognitionos_command_execution_via_importmro_subclass_chain_fallbacktest_mode_eval_oracleprompt_injection_resistance
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 224 — ModelVault — Path Traversal via OCI Manifest Digest— hackadvisor
- [web][Pro]Lab 84 — PulseView— hackadvisor
- [web][Pro]Lab 159 — ShareVault — Path Traversal via Filter Bypass in File Download— hackadvisor
- [web][Pro]Lab 314 — PixVault — ExifTool DjVu RCE via Image Upload— hackadvisor
- [web][Pro]Lab 343 — FrameCast — RCE via Ghostscript EPS Processing in Thumbnail Import— hackadvisor