Critical · published December 9, 2025
🚨 A single SQL injection flaw in Xinhu Rainrock RockOA 2.7.0 allows attackers to grab sensitive info with just a couple of parameters like shouji and userid! 🔥 Think of this as a delivery driver who accidentally opens the back door to a vault while trying to deliver a package, giving anyone nearby access to sensitive documents and money stacks. An attacker could waltz in and extract sensitive information, including administrator credentials, password hashes, and your entire database structure. This could lead to catastrophic breaches, exposing critical data and putting your whole operation at risk!
Think of this as a delivery driver who accidentally opens the back door to a vault while trying to deliver a package, giving anyone nearby access to sensitive documents and money stacks. The vulnerability in the setwxqyAction function allows an attacker to manipulate SQL queries by injecting malicious inputs through the shouji and userid parameters, bypassing authentication and gaining unauthorized access to the database.
An attacker could waltz in and extract sensitive information, including administrator credentials, password hashes, and your entire database structure. This could lead to catastrophic breaches, exposing critical data and putting your whole operation at risk! Update to Xinhu Rainrock RockOA version 2.7.1 immediately to patch this vulnerability. Additionally, review your code to implement prepared statements that can prevent SQL injection attacks going forward. You've got this! Follow these steps, and you’ll have your defenses up in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| rockoa/rockoa | all versions | — |