CVE-2026-84109: SQL Injection in Xinhu Rainrock RockOA

A SQL injection vulnerability exists in Xinhu Rainrock RockOA up to version 2.7.6 in the getOrder function of the webmain/webmainAction.php file. Remote attackers can exploit this by manipulating the 'highorder' parameter, potentially allowing unauthorized SQL commands to be executed. The vendor has not provided a response or patch, and public exploit code is available. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access or modification. However, the impact is rated as medium due to the low to limited impact on confidentiality, integrity, and availability as per the CVSS 4.0 vector. No known active exploitation in the wild has been reported.

No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor communications for updates. Until a fix is released, consider applying application-level input validation or web application firewall (WAF) rules to detect and block malicious SQL injection attempts targeting the 'highorder' parameter.