TIMP — OS Command Injection with IFS and Null Byte Filter Bypass
A POST endpoint executes a shell command with user-supplied input but filters spaces, the word ’echo’, and other shell metacharacters. Bypass with ${NULL} (strips to nothing) and ${IFS} (the internal field separator, expands to a space in bash).