This is the quickest RCE I've ever gotten.
The app has a popup for multi-selection fields. I intercepted the request, expecting XSS or SQLi, but found that the parameter **_session_name= can be exploited to get an
#RCE as a surprise.
Payload: `&**='.print((`id`)).'`
#BugBounty