SQL Injection Vulnerability in Xinhu Rainrock RockOA

A SQL injection vulnerability exists in Xinhu Rainrock RockOA versions 2.7.6 and earlier, specifically within the kqjcmdModel::returnchuli function of the openkqjAction.php file. The vulnerability is located in the Openkqj Action component and is triggered by improper sanitization of the ID argument during web requests. Remote attackers can leverage this flaw to manipulate database queries, potentially leading to unauthorized data exfiltration or modification. The vulnerability has been publicly disclosed, and proof-of-concept exploit code is currently circulating. The vendor, Xinhu, was notified prior to public disclosure but failed to respond, and no official patch is currently available. Organizations utilizing RockOA in internet-facing environments are at high risk of exploitation by automated scanners and opportunistic attackers.

Impact

Successful exploitation allows unauthenticated remote attackers to perform unauthorized database operations. This can lead to full compromise of the application data stored within the backend database, potentially including administrative credentials, user information, or sensitive organizational records. Given the public availability of exploit code, the risk of automated mass exploitation is high.

Recommendation

Prioritize the identification of all internet-facing Xinhu Rainrock RockOA instances within the environment. Since no patch is available, implement restrictive access controls at the web application firewall (WAF) or network perimeter to block requests targeting the openkqjAction.php endpoint. Monitor web server logs for suspicious patterns in the ID parameter, particularly the inclusion of SQL syntax characters such as single quotes, semicolons, or common SQL injection keywords like UNION, SELECT, or SLEEP.