Rendering template whose name is stored in a variable issue

[andrew-3]

{% liquid
	assign path = 'path/to/file'
	render ""'path'
%}

This code will try to render the template whose path is path/to/file. This is probably not intended. Credit for this find goes to Rich Lane from One Orange Cow.

[richxrich]

Thanks @andrew-3 , the exploit code paste wasn't 100% correct. I have not had time but I suspect this could be used in a number of different ways to inject code where it shouldn't be

{% liquid
	assign path = 'path/to/file'
	render ''"{{path}}"
%}

This example renders the page using a variable

[andrew-3]

@richxrich I omitted the curly braces because it works even without them.