Xeams: Unauthenticated Root RCE via SQLRunner.jsp Derby Hardcoded Credentials and JSP Webshell

Xeams 10.3 build 6449 ships SQLRunner.jsp reachable without authentication — web.xml declares no *.jsp security-constraint and the SynaFilter maps only /FrontController/*. The operation=1 branch connects to the embedded Derby DB using hardcoded DB-owner credentials (system/manager); operation=2 calls SYSCS_UTIL.SYSCS_EXPORT_QUERY to write a JSP webshell into the Tomcat docBase, and a GET triggers Jasper on-demand compilation and Runtime.exec — unauthenticated root RCE.