Rainrock RockOA CVE-2026-108571

Exploitation requires network reachability to the RockOA web application's openapi interface, specifically the webmain/task/openapi/openkqjAction.php endpoint handling the Openkqj Action, where a crafted value in the ID argument reaches kqjcmdModel::returnchuli without sanitization. Per CVSS PR:N/UI:N, no authentication and no user interaction are needed, and AC:L indicates no special timing or configuration preconditions, so default installations of RockOA up to and including 2.7.6 that expose this openapi endpoint are exploitable. The main limiting factors are the product's niche deployment and whether the openapi endpoint is network-exposed rather than firewalled internally; impact is bounded to partial confidentiality, integrity, and availability per the vector.

This is an unauthenticated, remotely exploitable SQL injection (CWE-89) in the ID argument of the Openkqj Action endpoint, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms it requires no privileges, no user interaction, and low complexity - a genuinely low-barrier network attack. Mitigating the severity, the impact metrics are only partial across the board (VC:L/VI:L/VA:L), yielding a moderate 6.9 base score rather than a critical rating, which is consistent with an injection that discloses or manipulates a subset of data rather than granting full database or system compromise. The CVSS E:P (Proof-of-Concept) flag aligns with the stated public availability of exploit code, so publicly available exploit code exists; however, this is NOT confirmed active exploitation - the CVE is not listed in CISA KEV and no EPSS score was provided, so real-world exploitation volume is unknown. No SSVC decision data was supplied. The dominant risk driver is the combination of zero authentication and a public exploit against a vendor that did not respond to disclosure, meaning no patch is confirmed; the primary dampening factor is the niche deployment footprint of this product, which makes widespread automated exploitation less likely than for mainstream software despite the easy attack path.

A remote attacker with no account sends a crafted request to webmain/task/openapi/openkqjAction.php, injecting malicious SQL into the ID parameter processed by kqjcmdModel::returnchuli. Because a public proof-of-concept exploit is available and no authentication is required, the attacker can extract or tamper with portions of the backend database directly over the network. Low attack complexity means the request can be delivered with minimal tailoring.