This module exploits a SQL injection and command injection vulnerability in MicroFocus Secure Messaging Gateway. An unauthenticated user can execute a terminal command under the context of the web user. One of the user supplied parameters of API endpoint is used by the application without input validation and/or parameter binding, which leads to SQL injection vulnerability. Successfully exploiting this vulnerability gives the ability to add a new user onto the system. manage_domains_dkim_keygen_request.php endpoint is responsible for executing an operating system command. It's not possible to access this endpoint without having a valid session. Combining these vulnerabilities gives the opportunity to execute operating system commands under the context of the web user.