CVE-2025-63740: SQL Injection
SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the actstr parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-63740?
CVE-2025-63740 is considered a high severity SQL Injection vulnerability that can expose sensitive information.
How do I fix CVE-2025-63740?
To fix CVE-2025-63740, ensure that input validation and parameterized queries are implemented to prevent SQL injection attacks.
What systems are affected by CVE-2025-63740?
CVE-2025-63740 affects Xinhu Rainrock RockOA version 2.7.0.
What information can be accessed through CVE-2025-63740?
CVE-2025-63740 allows attackers to gain access to sensitive data such as administrator accounts, password hashes, and database structure.
Is there a workaround for CVE-2025-63740?
A temporary workaround for CVE-2025-63740 includes sanitizing inputs to the actstr parameter until a patch is available.