Rainrock Rockoa
Monthly
SQL injection in Xinhu Rainrock RockOA (versions up to 2.3.2) allows low-privileged remote attackers to manipulate database queries via the `Value` argument in the `toaddval` function at `/index.php?m=index&a=publicsavevalue&ajaxbool=true`. A public proof-of-concept exploit exists, and the vendor did not respond to responsible disclosure, leaving no official patch available. CVSS 4.0 rates impact as uniformly Low across confidentiality, integrity, and availability, suggesting bounded data exposure rather than full database compromise. No public exploit identified at time of analysis meets the CISA KEV threshold.
SQL injection in Xinhu Rainrock RockOA up to version 2.7.6 allows authenticated remote attackers to manipulate backend database queries via the `highorder` argument in the `getOrder` function of `webmain/webmainAction.php`. The CVSS 4.0 vector confirms network-accessible exploitation requiring low-privilege authentication, with limited but real confidentiality, integrity, and availability impact. A public proof-of-concept exploit has been published on GitHub (E:P); the vendor did not respond to coordinated disclosure, leaving no official patch available.
SQL injection in Xinhu Rainrock RockOA (versions up to 2.3.2) allows low-privileged remote attackers to manipulate database queries via the `Value` argument in the `toaddval` function at `/index.php?m=index&a=publicsavevalue&ajaxbool=true`. A public proof-of-concept exploit exists, and the vendor did not respond to responsible disclosure, leaving no official patch available. CVSS 4.0 rates impact as uniformly Low across confidentiality, integrity, and availability, suggesting bounded data exposure rather than full database compromise. No public exploit identified at time of analysis meets the CISA KEV threshold.
SQL injection in Xinhu Rainrock RockOA up to version 2.7.6 allows authenticated remote attackers to manipulate backend database queries via the `highorder` argument in the `getOrder` function of `webmain/webmainAction.php`. The CVSS 4.0 vector confirms network-accessible exploitation requiring low-privilege authentication, with limited but real confidentiality, integrity, and availability impact. A public proof-of-concept exploit has been published on GitHub (E:P); the vendor did not respond to coordinated disclosure, leaving no official patch available.