Rainrock RockOA CVE-2025-63737

Exploitation requires an attacker to deliver a crafted URL to the task.php endpoint containing a malicious payload in the m parameter, which is reflected by the urltestAction function in cliAction.php of RockOA 2.7.0. The key limiting factor is required user interaction (CVSS UI:R): a victim must open the attacker-supplied link in their browser for the injected script to execute - this is not a server-side compromise and does not run automatically. No attacker authentication is needed (PR:N), and impact is confined to the client-side context of the user who clicks (session data, DOM, actions as that user); exploitation is constrained to deployments running the affected RockOA 2.7.0 version.

This is a reflected cross-site scripting flaw (CWE-79) with a CVSS 3.1 base score of 6.1 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The vector indicates a network-reachable, low-complexity issue requiring no attacker privileges but requiring user interaction (UI:R), with a changed scope and limited confidentiality/integrity impact and no availability impact - a signal profile fully consistent with a reflected XSS requiring a victim to click a crafted link. No EPSS score was supplied in the input, and the vulnerability is NOT listed in CISA KEV, so there is no evidence of active exploitation; however, the NVD reference points to a GitHub issue flagged as an exploit, so publicly available exploit code exists. The signals are internally consistent (medium-severity reflected XSS, exploit code public, no confirmed in-the-wild use), so this reads as a genuine but moderate-priority issue rather than a critical one: real because exploit details are public and the attack is remote/low-complexity, but bounded because it needs user interaction, yields only limited client-side impact (session/DOM-level), and affects a niche product. Missing data: no EPSS probability and no vendor advisory or patch were provided, so exploitation likelihood and fix availability cannot be independently confirmed from the input.

An attacker crafts a malicious URL targeting the task.php endpoint with a payload in the vulnerable m parameter (urltestAction in cliAction.php) and lures an authenticated RockOA user into clicking it (e.g., via phishing). When the victim's browser renders the reflected response, the injected script executes in the RockOA origin, allowing session/cookie theft or actions in the user's context. Publicly available exploit/PoC details are referenced in the vendor's GitHub issue tracker.