3 ms·

Does generating that substitute value imply launching a shell command?

• ComodoHacker 9y ago
  No. But template expression language used in Struts is quite expressive. :) There's some defensive system to prevent access to arbitrary classes, but the attacker managed to overcome it in a clever way.