Xinhu RockOA CVE-2025-63740

Exploitation requires network reachability to the RockOA 2.7.0 web interface and the ability to send requests to the inputAction.php getselectdataAjax endpoint with a controllable actstr parameter; per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are required. The only stated limiting factors are the AV:A designation in the provided vector (suggesting adjacent-network rather than full internet reach - though this conflicts with a typical web-app SQLi and should be verified) and the requirement that the vulnerable 2.7.0 version be deployed and the endpoint accessible to the attacker.

This is a genuine but relatively low-urgency issue. The CWE-89 SQL injection in RockOA 2.7.0's getselectdataAjax function (inputAction.php, actstr parameter) is confirmed by a publicly available exploit referenced from the vendor's own GitHub issue tracker (rainrocka/xinhu issue #13), so publicly available exploit code exists - but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The supplied CVSS 3.1 vector (4.3, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is internally inconsistent with the description: it specifies AV:A (adjacent network) and only C:L (low confidentiality), yet the description claims extraction of administrator accounts, password hashes, and full database structure, which for a web-facing PHP application normally implies AV:N (network) and C:H - verify the attack vector and confidentiality magnitude with the source, as the input scoring appears to understate impact. The combination of a public POC against an unauthenticated (PR:N) network-reachable endpoint raises real risk for any exposed instance, but the product's limited deployment footprint keeps this well below the priority of a comparable flaw in ubiquitous software.

An attacker who can reach a RockOA 2.7.0 web instance sends a crafted request to inputAction.php's getselectdataAjax endpoint with a malicious actstr parameter, injecting SQL that is returned in the response. A public proof-of-concept exists, and because the CVSS vector lists PR:N the attack requires no authentication, letting the attacker dump administrator credentials and password hashes directly from the database.