Form Tools versions 3.1.0 and 3.1.1 contain a server-side request forgery vulnerability in the smart_fill function of the AJAX Endpoint component (/global/code/actions.php). This vulnerability allows remote attackers to manipulate the url argument, causing the server to make unintended requests. The issue was reported to the project early, but no official fix or response has been provided. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation of this SSRF vulnerability can allow an attacker to make arbitrary requests from the vulnerable server, potentially accessing internal resources or services not directly accessible from the internet. The published exploit increases the likelihood of attacks, although no active exploitation in the wild has been reported. The vulnerability requires no user interaction and has low attack complexity.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, consider implementing network-level restrictions to limit the server's ability to make outbound requests to untrusted destinations. Review and restrict access to internal services that could be targeted via SSRF.