CVE-2025-63742

Critical

Published: 09/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters.

Risk Assessment

An attacker can gain access to administrator accounts and sensitive data, compromising confidentiality and integrity of the system.

Recommendation

Apply vendor patches or restrict access to loginAction.php, and use parameterized queries.

Original NVD description (English source)

SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters.