CVE-2026-84153: Xinhu Rainrock RockOA index.php toaddval sql injection
A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. The impacted element is the function toaddval of the file /index.php?m=index&a=publicsavevalue&ajaxbool=true. Executing a manipulation of the argument Value can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates low privileges are required. Exploitation can be performed remotely, requires no user interaction, and has low attack complexity.
Which versions should be assessed?
Xinhu Rainrock RockOA versions up to and including 2.3.2 are identified as affected.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
Has the vendor responded to the disclosure?
The vendor was contacted early about the disclosure but did not respond, according to the available information.