How I Found a Working SSTI in an Online Store -and Why It Was Medium, Not Critical

A real-world case: bypassing client-side validation with Burp Suite, confirming Server-Side Template Injection in Jinja2, and hitting the…