SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the actstr parameter.
References
| Link | Resource |
|---|---|
| https://github.com/rainrocka/xinhu/issues/13 | Exploit Issue Tracking Third Party Advisory |
Configurations
History
12 Dec 2025, 12:28
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Rockoa
Rockoa rockoa |
|
| References | () https://github.com/rainrocka/xinhu/issues/13 - Exploit, Issue Tracking, Third Party Advisory | |
| CPE | cpe:2.3:a:rockoa:rockoa:2.7.0:*:*:*:*:*:*:* |
10 Dec 2025, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| CWE | CWE-89 |
09 Dec 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-09 17:15
Updated : 2025-12-12 12:28
NVD link : CVE-2025-63740
Mitre link : CVE-2025-63740
CVE.ORG link : CVE-2025-63740
JSON object : View
Products Affected
rockoa
- rockoa
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')