EIP-2026-111691

This exploit chains SQL injection (CVE-2019-19509) and command injection (CVE-2019-19585, CVE-2020-10220) in rConfig 3.9.4 to achieve unauthenticated root RCE via a reverse shell. It adds a temporary admin user, authenticates, and triggers a payload through the `ajaxArchiveFiles.php` endpoint.