EIP-2026-117340

This writeup describes an arbitrary SQL/code execution vulnerability in QuickBooks Desktop (2007-2016) due to unvalidated SQL scripts in company files. The PoC demonstrates launching Notepad.exe via embedded SQL commands, highlighting the risk of malicious payloads in QBW, QBA, QBX, and QBM files.