Impact

Successful exploitation allows unauthenticated remote attackers to perform unauthorized database operations. This can lead to full compromise of the application data stored within the backend database, potentially including administrative credentials, user information, or sensitive organizational records. Given the public availability of exploit code, the risk of automated mass exploitation is high.

Recommendation

Prioritize the identification of all internet-facing Xinhu Rainrock RockOA instances within the environment. Since no patch is available, implement restrictive access controls at the web application firewall (WAF) or network perimeter to block requests targeting the openkqjAction.php endpoint. Monitor web server logs for suspicious patterns in the ID parameter, particularly the inclusion of SQL syntax characters such as single quotes, semicolons, or common SQL injection keywords like UNION, SELECT, or SLEEP.