Description

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. Affected by this issue is the function getOrder of the file webmain/webmainAction.php. Executing a manipulation of the argument highorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-01T14:17:47.923Z",
  "pubdate": "2026-09-01T14:17:47.923Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in Xinhu Rainrock RockOA versions up to 2.7.6. The flaw exists within the getOrder function located in webmain/webmainAction.php, allowing remote, unauthenticated attackers to execute arbitrary SQL commands.\nThe vulnerability stems from improper neutralization of the highorder argument, which is directly processed by the application's database layer. Successful exploitation enables unauthorized actors to manipulate backend database queries, potentially leading to unauthorized data exfiltration, modification of database contents, or complete compromise of the underlying database server.\nGiven that public exploit code is available and the vendor has remained unresponsive to disclosure efforts, the risk of active exploitation is significant. Organizations running affected versions are exposed to severe integrity and confidentiality threats. Immediate attention is required to isolate or secure the affected component.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located in the getOrder function within the file webmain/webmainAction.php. The root cause is the insecure handling of the highorder input parameter, which acts as a direct injection vector. The application fails to implement adequate input sanitization, parameterization, or escape mechanisms before passing this user-supplied value into a dynamic SQL query.\nThe attack flow begins with a remote attacker sending a crafted HTTP request to the vulnerable endpoint. By manipulating the highorder argument, an attacker can inject malicious SQL fragments that terminate the intended query and append arbitrary malicious commands. Because the database driver processes the query as a single command string, the injected syntax is executed with the privileges of the application's database user.\nExploitation does not inherently require prior authentication, making it a highly accessible remote attack vector. The impact of this flaw is substantial; an attacker can bypass authentication, enumerate database structures, extract sensitive administrative or user credentials, or modify existing data to escalate privileges within the application. In environments where the database service account has broad permissions, an attacker might leverage database-specific commands to perform operating system-level interactions.\nThe vulnerable code snippet within webmain/webmainAction.php inadequately treats the user-provided 'highorder' value as a trusted string, concatenated directly into a query builder or raw execution function. This bypasses the security boundary designed to prevent unintended interaction with the database schema. The lack of parameterized queries or prepared statements is the primary driver of this susceptibility. Since the vendor has not provided a patch, the application remains continuously vulnerable in its default configuration. The exploit, which has been publicly disseminated, provides a ready-to-use template for malicious actors to conduct automated or targeted reconnaissance and data exfiltration against exposed instances of RockOA versions 2.7.6 and below."
}