RCE as admin has been a problem for over a decade. _Globally_ sessions do not expire... This is just the tip of the shit architecture iceberg.