CVE-2026-108571: SQL Injection in Xinhu Rainrock RockOA

This vulnerability in Xinhu Rainrock RockOA up to version 2.7.6 allows remote attackers to exploit a SQL injection flaw in the kqjcmdModel::returnchuli function of the Openkqj Action component. The flaw arises from improper handling of the ID argument in the specified PHP file, enabling attackers to inject malicious SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. Public exploit code is available, but the vendor has not issued any response or patch.

Successful exploitation could allow an attacker to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts. No evidence of active exploitation in the wild has been reported.

No official patch or vendor advisory is available at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to the vulnerable endpoint and monitor for suspicious activity related to SQL injection attempts.