PT-2026-6452
Published
2026-01-02
·
Updated
2026-01-02
Description by
CVSS 3.1
8.8
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
SSTI is possible via first name and last name parameters provided by lowest-privileged users.
Details
- Go to
http://127.0.0.1:8000/and login or signup - Go to
http://127.0.0.1:8000/customer/account/profile - Now edit the first name and last name to {{7*7}}
- Notice it appears as 49
POC
- Video attached with the report: https://github.com/user-attachments/assets/f93932b5-2a57-4f34-897e-4151a5168912
Impact
This can lead to RCE, command injection.
Found an issue in the description? Have something to add? Feel free to write us 👾