Charon -

This is a devious machine I think. Lot’s of things to figure out before even getting a shell. Let’s say I have administrator access to the cms. How to go from there? Without any spoilers please! Is the ‘hidden’ encoded value to be found somewhere of any significance?

Any luck with this? I have found that value too, trying to use it produces nil.

Yes it is useful. It is a combination of what you found and bypassing the restrictions/filters. Mess around with it while passing unrestricted data to see how it works, then focus on bypassing the restrictions.