CVE-2019-9846

RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause…

published March 16, 2019

CVSS
—
EPSS
2%
Percentile
76.7
In the wild
Unconfirmed
What it is

RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01675 · 76.7th percentile
Published
2019-03-16T12:00Z
EPSS history
Timeline
  • 16 MAR 12:00Z
    RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause…
    cvelistv5