Remote code execution via stored PHP configuration

Code injection in Rukovoditel 3.2.1 allows remote authenticated users to execute PHP code through the dashboard AJAX endpoint. The endpoint executes attacker-chosen PHP stored in the configuration of the app_fields row selected by field_id instead of treating it as noncode data. Exploitation requires prior insertion of a fieldtype_ajax_request row through a separate SQL injection plus an administrator cookie and form_session_token; successful exploitation runs commands with the web server's privileges.