Roxy-WI up to and including 5.2.2.0 allows authenticated SQL injection via select_servers.
roxy-wi roxy-wi