EIP-2026-103978

This exploit leverages an unauthenticated SQL injection vulnerability in ManageEngine Security Manager Plus to write a JSP shell to the server, enabling remote code execution with SYSTEM/root privileges. The payload crafts a malicious SQL query to write a reverse shell JSP file, which is then accessed to trigger the shell.