Xinhu RockOA CVE-2025-63742

Exploitation targets the setwxqy function in webmain/task/api/loginAction.php and requires sending unsanitized input through the shouji and userid request parameters to a reachable RockOA 2.7.0 instance. Because this is a login-side API endpoint, no authentication is needed (consistent with PR:N) and no user interaction is required. The primary limiting factors are that the target must be running the specific vulnerable version 2.7.0 and the loginAction.php API endpoint must be network-reachable (typically internet- or intranet-exposed); there is no indication that a non-default configuration is required.

Multiple signals align toward genuine priority for anyone running the affected product, but deployment footprint tempers the absolute risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no privileges or user interaction, and the CWE-89 classification plus the description (injection reachable via the shouji and userid parameters in loginAction.php, a pre-authentication login endpoint) are internally consistent with PR:N - a rare case where the vector and description agree cleanly. A public proof-of-concept is referenced (the vendor's own GitHub issue tracker), which raises practical exploitability. However, two important signals are MISSING from the input: there is no EPSS exploitation-probability score and no CISA KEV listing provided, so there is no evidence of active, in-the-wild exploitation - only that exploit code exists. The scope is also narrow: RockOA is a niche Chinese office-automation product, so despite the 9.8 rating this is not a mass-internet event on the scale of a ubiquitous-component flaw. Net assessment: a real, high-urgency issue for the specific population of RockOA 2.7.0 operators (unauthenticated, trivial, PoC-backed data theft), but a limited-blast-radius issue globally. The 9.8 severity reflects per-instance impact, not widespread prevalence.

An unauthenticated attacker locates an internet-exposed RockOA 2.7.0 instance and sends a crafted request to the setwxqy action in loginAction.php, injecting SQL through the shouji or userid parameter. Because a public proof-of-concept exists on the vendor's issue tracker, exploitation requires little custom tooling; the attacker extracts administrator accounts, password hashes, and database schema, then leverages the recovered credentials for full application compromise.