CVE-2026-84109
MediumCVSS 6.3Summary
Xinhu Rainrock RockOA up to version 2.7.6 has an SQL injection vulnerability in the getOrder function of webmain/webmainAction.php. Manipulating the highorder argument can lead to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
An attacker can gain unauthorized access to the database, potentially leading to confidentiality, integrity, and availability breaches.
Recommendation
Update RockOA to the latest version if available, or apply other mitigations such as input validation.
Other vulnerabilities in Xinhu Rainrock RockOA
See all- CVE-2026-84153Medium
A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. The impacted element is the function toaddval of the file /index.php?m=index&a=publicsavevalue&ajaxbool=true. Executing a manipulation of the argument Value can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2025-63742Critical
SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters.
Original NVD description (English source)
A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. Affected by this issue is the function getOrder of the file webmain/webmainAction.php. Executing a manipulation of the argument highorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.