Telaeris XPressEntry unauthenticated SQLi RCE

Unauthenticated POST /activities injects stacked T-SQL via sNotes to enable xpcmdshell and run attacker commands on the backend SQL Server. !/usr/bin/env python3 -- coding: utf-8 -- """Telaeris XPressEntry unauthenticated SQL injection to xpcmdshell.""" from future import annotations import uuid...