CVE-2024-22722

Form Tools stores its templates in a way that treats the Group Name field as executable rather than as text, so a string typed into the add-forms screen gets evaluated by the template engine instead of displayed. The practical result is command execution on the host, but the catch is who can reach that field: this sits behind an authenticated, high-privilege area of the application, so an attacker already needs administrative footing to trigger it.

That precondition changes how worried we should be. This is not something a mass-scanning botnet flips a switch on across the internet; it's an admin-to-RCE, the kind of thing that matters most as a post-compromise escalation or when a legitimate operator turns malicious. Where it does bite is any Form Tools deployment where 'admin' is loosely granted or shared, because the leap from that account to shell on the box is then trivial.

We treat this one according to its real gate rather than its 7.2. Our first question is which internet-facing Form Tools instances we run at all, and of those, how tightly the administrative role is scoped and monitored. If admin access is already well-controlled, this ranks below its score; if we have Form Tools admin panels reachable from untrusted networks with weak account hygiene, it jumps the queue because the SSTI removes the last wall between an admin session and the operating system.