Executive brief
Xinhu RockOA is an office automation system used for workflow management and document collaboration. A SQL injection vulnerability in the getOrder function allows authenticated users to manipulate database queries through the highorder parameter, potentially leading to unauthorized data access, modification, or deletion of sensitive business information stored in the database.
Technical details
The vulnerability is a time-based blind SQL injection in the getOrder method of webmain/webmainAction.php. The highorder POST parameter is passed through an insufficient sanitization function (iconvsql) that only blocks parentheses without spaces, which can be bypassed by inserting spaces (e.g., "IF ("). An authenticated attacker with valid session cookies can inject SQL through the publicstoreAjax→limitRows→getOrder call chain, executing arbitrary SQL commands such as data exfiltration or manipulation. The vulnerability requires valid user authentication and PHPSESSID/xinhu_mo_adminid cookies. No patch information is currently available; the vendor did not respond to early disclosure.
Affected products
- Xinhu RockOA up to 2.7.6
Timeline
- 2026-07-06: disclosed: Vulnerability reported on GitHub
- 2026-09-01: advisory: Published to NVD
- 2026-09-01: other: Exploit proof-of-concept made publicly available