Jacks FormMail.php script can be manipulated into sending arbitrary files from the server. Version 5.0 is affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/35577/jackformail.txt
Source: https://packetstormsecurity.com/files/35577/jackformail.txt.html