CVE-2025-63737

SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters.

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6, impacting the kqjcmdModel::returnchuli function in webmain/task/openapi/openkqjAction.php of the Openkqj Action component. Manipulation of the ID argument causes SQL injection. The attack can be carried out remotely and the exploit is publicly available.

A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. The impacted element is the function toaddval of the file /index.php?m=index&a=publicsavevalue&ajaxbool=true. Executing a manipulation of the argument Value can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Xinhu Rainrock RockOA up to version 2.7.6 has an SQL injection vulnerability in the getOrder function of webmain/webmainAction.php. Manipulating the highorder argument can lead to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the component API. This manipulation of the argument callback causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allows attackers to gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the actstr parameter.

An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing authenticated users to modify PHP configuration files via the a parameter to the index.php endpoint.

An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo through the a parameter to index.php.