RockOA CVE-2025-63738

Exploitation requires a low-privilege authenticated session (CVSS PR:L) to the RockOA 2.7.0 web application; the attacker then supplies a specific crafted value in the 'a' parameter of index.php to coerce the application into returning phpinfo() output. The primary limiting factor is the authentication requirement - this is not exploitable by fully unauthenticated attackers per the CVSS vector. No user interaction is needed (UI:N), and the attack is network-reachable (AV:N) against an exposed RockOA instance. Impact is confined to disclosure of PHP/server configuration details (C:L); there is no integrity or availability impact and no direct code execution from this specific behavior as described.

This is a low-to-moderate priority issue despite the 'exploit available' signal. The CVSS base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a network-reachable but authenticated (PR:L) information-disclosure flaw with only low confidentiality impact and no integrity or availability impact. EPSS is low at 0.26% (17th percentile), consistent with the absence of a CISA KEV listing - there is no evidence of active, widespread exploitation. A public exploit reference exists (the vendor's own GitHub issue tracker), so publicly available exploit code exists, but POC availability is a distinct signal from active exploitation and should not be conflated. Note a data tension worth verifying: the assigned CWE-98 (improper control of filename for PHP include/require, i.e. RFI/LFI) and the 'LFI' tag imply code/file inclusion, whereas the description characterizes the impact strictly as phpinfo() output disclosure - an information leak, not file inclusion or code execution. The CVSS impact metrics (C:L only) align with the description's info-disclosure framing rather than the more severe CWE-98 classification, so the true vulnerability class should be confirmed with the vendor. Net: real but low-urgency for most defenders; the leaked phpinfo data (paths, modules, environment) is primarily useful as reconnaissance to enable further attacks.

An attacker with low-privilege authenticated access to a RockOA 2.7.0 instance sends a crafted request to index.php with a specific value in the 'a' parameter, causing the application to return phpinfo() output. The leaked configuration (server paths, loaded PHP modules, environment variables) is then used as reconnaissance to plan follow-on attacks. A public exploit/proof-of-concept is referenced in the vendor's GitHub issue tracker.