'Render A text from python Flask input

i need to render a text from a text input field, this is my app.py

@app.route("/")
@app.route("/",methods=['POST'])
def data():
    text = request.form['command']
    return render_template("exploit.html") + text

if __name__ == '__main__':
    app.run(debug=1)

and this my exploit.html code

<body>
<form action="POST">
    <label>Command: </label>
    <input type="text" name = "command"> 
    <input type = "submit" value = "send">
</form>

actually i'm trying some remote code execution from that text input



Solution 1:[1]

You can pass variables to jinja2 templates by adding arguments to render_template function.

    return render_template("exploit.html", text = text)

They can be accessed later by using {{}}, like so:

<body>
{{text}}
<form action="POST">
    <label>Command: </label>
    <input type="text" name = "command"> 
    <input type = "submit" value = "send">
</form>

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source
Solution 1