Rainrock RockOA CVE-2026-84153

Exploitation requires a valid low-privilege authenticated session in the Rainrock RockOA application (CVSS PR:L); unauthenticated access to this endpoint has not been established. The vulnerability is in a specific AJAX endpoint (ajaxbool=true) used by the toaddval function, which must be reachable over the network. No special non-default configuration is required beyond having a functioning OA installation. Limiting factors include: (1) the attacker must possess a valid OA user account, ruling out fully external opportunistic attacks; (2) the CVSS 4.0 impact ratings of Low across all dimensions suggest the injectable query context limits how much data can be accessed or modified in a single exploit; (3) successful exploitation requires the OA web interface to be network-reachable from the attacker's position.

The CVSS 4.0 score of 2.1 is notably low for a SQL injection, driven by uniformly Low impact ratings (VC:L/VI:L/VA:L) with no subsequent-system impact (SC:N/SI:N/SA:N). This suggests the injectable query returns or affects only a narrow slice of data, not a full database dump. The E:P modifier confirms a public exploit exists, elevating operational risk somewhat. There is no CISA KEV listing, and no EPSS data was provided. The primary risk driver is the absence of a vendor patch - the vendor did not respond to disclosure - leaving all installations permanently exposed until a third-party fix or workaround is applied. For organizations running this OA software, the real-world risk is moderate-to-elevated not because of CVSS score but because of the public POC combined with no remediation path. SQL injection in OA platforms often allows escalation to higher-impact actions (session hijacking, stored data exfiltration) even with 'Low' rated impact fields - defenders should treat the limited-impact rating as tentative pending deeper analysis.

An authenticated low-privilege user (e.g., a regular OA employee account) crafts an HTTP request to /index.php?m=index&a=publicsavevalue&ajaxbool=true with a SQL-injected Value parameter, such as a UNION-based payload to extract database contents. A public proof-of-concept exists at the referenced GitHub issue, lowering the barrier to exploitation. The attacker could enumerate table structures, extract user credentials or business data stored in the OA database, or in some configurations write to records they would not normally have access to.