Xinhu RockOA CVE-2025-63739

Requires a valid authenticated RockOA account (CVSS PR:L); the attacker then reaches the phpinisaveAction handler in webmain/system/cogini/coginiAction.php by supplying the 'a' parameter to the index.php endpoint, with no user interaction needed (UI:N). Limiting factors: exploitation is gated on prior authentication and is specific to RockOA 2.7.0; it is not available to anonymous/unauthenticated remote attackers, which materially reduces real-world exposure.

This is a genuinely low-priority issue despite the publicly available POC. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3 Medium) shows a network-reachable, low-complexity flaw but one that REQUIRES an existing authenticated account (PR:L) and yields only limited integrity impact (I:L) with no confidentiality or availability loss and no scope change. There is no EPSS score, SSVC decision data, or KEV listing supplied, so there is no evidence of active exploitation - exploitation status is limited to a public POC on the vendor's own issue tracker. The tag 'Authentication Bypass' conflicts with the CVSS vector and CWE-284 (Improper Access Control): PR:L means the attacker must already be authenticated, so this is an authorization/access-control flaw (an authenticated user reaching functionality they should not), NOT an authentication bypass - defenders should not treat it as pre-auth. One under-stated factor: the I:L rating may undercount real impact, because the ability to modify PHP configuration files (php.ini) can disable security directives or enable dangerous functions, potentially escalating toward code execution - verify downstream impact with the vendor. Overall: low real-world risk driven by the authentication requirement and niche product footprint, not a high-urgency item.

An attacker who already holds a valid low-privileged RockOA account sends a crafted request to the index.php endpoint invoking the phpinisaveAction function (via the 'a' parameter) to write to PHP configuration files they should not control. A public POC exists on the vendor's GitHub issue tracker, lowering the skill barrier, though the attacker must first authenticate to the application.