[jump]

Well its hard    even after bypassing forti source , we dint have a memory location to write to  , after finding that , send a shell code , rewrite it with return address .  or there is some other way that i am not aware of  , we certainly need help from someone who has  bigger brains .

The person who writes the RCE for this they'll have my full respect . 

seems you're so close to get RCE, I hope you do that.
Is there any chance to share that if you got working payload?

[AnonBF]

Well its hard    even after bypassing forti source , we dint have a memory location to write to  , after finding that , send a shell code , rewrite it with return address .  or there is some other way that i am not aware of  , we certainly need help from someone who has  bigger brains .

The person who writes the RCE for this they'll have my full respect . 

seems you're so close to get RCE, I hope you do that.
Is there any chance to share that if you got working payload?

Any updates here?