Description

A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. The impacted element is the function toaddval of the file /index.php?m=index&a=publicsavevalue&ajaxbool=true. Executing a manipulation of the argument Value can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-01T16:17:32.710Z",
  "pubdate": "2026-09-01T16:17:32.710Z",
  "executiveSummary": "Xinhu Rainrock RockOA versions up to 2.3.2 contain a critical SQL injection vulnerability within the /index.php?m=index&a=publicsavevalue&ajaxbool=true endpoint.\nThis vulnerability allows an unauthenticated remote attacker to inject malicious SQL commands via the 'Value' argument, potentially leading to unauthorized database access, data exfiltration, or complete compromise of the underlying database server.\nThe flaw stems from insufficient input validation and sanitization of user-supplied data before it is incorporated into database queries within the 'toaddval' function.\nGiven that public exploit code exists and the vendor has not provided a response or patch, the risk level is considered high. Attackers can perform this attack remotely without prior authentication, requiring no complex preconditions. Organizations using affected versions are at significant risk of database manipulation or sensitive information disclosure until appropriate security measures are implemented.",
  "technicalDetails": "The vulnerability resides in the 'toaddval' function located within the 'publicsavevalue' action of the index controller in RockOA versions 2.3.2 and earlier. The specific entry point is the URI '/index.php?m=index&a=publicsavevalue&ajaxbool=true'.\nThe root cause of this vulnerability is improper sanitization of the 'Value' HTTP request parameter. The application fails to adequately filter or parameterize user-provided input before passing it into database query strings executed by the backend database management system.\nAn attacker can exploit this by crafting a malicious payload within the 'Value' argument. Because the application logic does not use prepared statements or strictly validate the input against expected patterns, the injected SQL syntax is parsed and executed by the database engine.\nThe attack flow begins with the adversary identifying the target endpoint. The attacker then sends a crafted HTTP POST or GET request where the 'Value' parameter contains SQL injection primitives, such as single quotes, UNION operators, or comment sequences. When the 'toaddval' function processes this input, the payload alters the intended query structure, allowing the attacker to bypass access controls or execute arbitrary SQL commands.\nThis vulnerability is reachable from remote network locations and does not require the attacker to be authenticated to the application, lowering the bar for exploitation. The payload's behavior is limited only by the permissions of the database user account under which the web application operates.\nPost-exploitation impact is severe, potentially including the unauthorized retrieval of sensitive business data, credentials, or personal information stored within the RockOA database. Furthermore, in environments where database configurations permit, attackers may leverage the SQL injection to execute administrative operations or gain deeper footholds in the application infrastructure."
}