Rainrock RockOA CVE-2026-84109

The attacker must hold a valid authenticated session within RockOA (PR:L per CVSS 4.0 vector) - unauthenticated exploitation is not supported by available data. The vulnerable code path is triggered when a request reaches the getOrder function in webmain/webmainAction.php with a user-controlled highorder parameter; no non-default configuration setting or special feature flag is described as required. Exploitation is limited to: (1) possession of a valid RockOA account (the primary gating factor), (2) network connectivity to the RockOA web interface, and (3) the application running a version at or below 2.7.6. Exploitation is NOT limited by platform architecture, specific database engine version, or any other described prerequisite.

The CVSS 4.0 base score of 2.1 is notably low and warrants scrutiny: with AV:N/AC:L/AT:N/PR:L/UI:N and VC:L/VI:L/VA:L, a typical calculator would yield a higher base score, suggesting either aggressive modifier suppression or a miscalculation - this should be independently verified. The low C/I/A impact ratings (all 'Low') suggest the assessor constrained scope to partial database read/write rather than full database compromise, which may underestimate real-world SQL injection impact depending on database permissions and application architecture. The threat metric E:P (exploit proven/publicly available) is present, which in CVSS 4.0 elevates practical risk beyond the base score alone. No CISA KEV listing exists, meaning confirmed active exploitation is not established. The public POC on GitHub (https://github.com/Bu7terf1y/cve/issues/1) lowers the barrier for opportunistic attackers significantly. The authentication requirement (PR:L) is a meaningful limiting factor - an attacker must hold a valid RockOA account, which restricts exploitation to insiders, credential-theft scenarios, or weak-credential brute force. Overall: moderate real-world priority for organizations running RockOA, elevated by the absence of a vendor patch and the existence of a public POC.

An attacker with a valid RockOA user account sends a crafted HTTP request to webmain/webmainAction.php with a malicious highorder parameter value - for example, injecting a UNION SELECT or time-based blind payload into the ORDER BY clause. A public POC demonstrating this technique is available at https://github.com/Bu7terf1y/cve/issues/1. Because attack complexity is low and no special prerequisites beyond authentication are required, this scenario is feasible for any insider or attacker who has obtained valid credentials via phishing or credential reuse.