SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter.
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')