CVE-2012-1300

This exploit leverages a command injection vulnerability in phpFox <= 3.0.1 via the `ajax.php` endpoint. It abuses the `getComponent()` method's unsafe `eval()` call to execute arbitrary OS commands using PHP's backtick operator, bypassing restrictions on dots and parentheses.