A Flask loan calculator backed by MySQL that builds its JSON answers with Jinja templates behind regex and blacklist filters.
Not startedDockercommit 8fc839bx86_64 · aarch64Secret
Exploit the server-side template injection weakness of a Flask loan calculator backed by MySQL that builds its JSON answers with Jinja templates behind regex and blacklist filters and read the flag in /flag.
The brief for this lab lives in its repository.