CVE-2025-63742

SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/rainrocka/xinhu/issues/14	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:rockoa:rockoa:2.7.0:*:*:*:*:*:*:*

History

14 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de inyección SQL en la función setwxqyAction en el archivo webmain/task/api/loginAction.php en Xinhu Rainrock RockOA 2.7.0 permitiendo a los atacantes obtener información sensible, incluyendo cuentas de administrador, hashes de contraseñas, estructura de la base de datos y otros datos críticos a través de los parámetros shouji y userid.

Information

Published : 2025-12-09 17:15

Updated : 2026-10-14 22:10

NVD link : CVE-2025-63742

Mitre link : CVE-2025-63742

CVE.ORG link : CVE-2025-63742

JSON object : View

Products Affected

rockoa

rockoa

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-63742", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-63742", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-11T19:07:39.908566Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-09T17:15:55.360", "references": [{"url": "https://github.com/rainrocka/xinhu/issues/14", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n SQL en la funci\u00f3n setwxqyAction en el archivo webmain/task/api/loginAction.php en Xinhu Rainrock RockOA 2.7.0 permitiendo a los atacantes obtener informaci\u00f3n sensible, incluyendo cuentas de administrador, hashes de contrase\u00f1as, estructura de la base de datos y otros datos cr\u00edticos a trav\u00e9s de los par\u00e1metros shouji y userid."}], "lastModified": "2026-10-14T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rockoa:rockoa:2.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "060A6F42-DA6D-41A3-9AC6-E26401FF9791"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}