CVE-2025-63740: Rockoa SQL Injection Vulnerability

CVE-2025-63740 Overview

CVE-2025-63740 is a SQL injection vulnerability [CWE-89] in Xinhu Rainrock RockOA 2.7.0. The flaw resides in the getselectdataAjax function within inputAction.php. Attackers on an adjacent network can inject SQL statements through the actstr parameter without authentication. Successful exploitation exposes administrator accounts, password hashes, database schema, and other sensitive records. The vulnerability affects the office automation platform maintained by rockoa (rainrocka).

Critical Impact
Unauthenticated attackers on the local network can extract administrator credentials and database contents from RockOA 2.7.0 through the actstr parameter of getselectdataAjax.

Affected Products

Xinhu Rainrock RockOA 2.7.0
inputAction.php component (getselectdataAjax function)
Deployments exposing the RockOA web interface on adjacent networks

Discovery Timeline

2025-12-09 - CVE-2025-63740 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-63740

Vulnerability Analysis

The vulnerability exists in the getselectdataAjax handler defined in inputAction.php. The function accepts an actstr parameter from HTTP requests and concatenates the value into a SQL query without sanitization or parameterization. An attacker on an adjacent network can submit crafted input that alters the query structure. The confidentiality impact is limited to disclosure, with no direct integrity or availability effect according to the published vector. Exposed data includes administrator account records, password hashes, and the underlying database schema.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The actstr request parameter flows into a dynamically constructed SQL statement. RockOA 2.7.0 does not validate or bind the parameter before execution. This pattern allows boolean-based, union-based, or error-based injection depending on the query context.

Attack Vector

Exploitation requires network reachability to the RockOA web interface on the adjacent network. No authentication or user interaction is needed. An attacker issues an HTTP request to the inputAction.php endpoint invoking getselectdataAjax and supplies a malicious actstr value. The injected payload manipulates the SQL query to return arbitrary rows from tables holding user credentials and configuration data. Refer to the GitHub Issue #13 for the reporter's technical description.

Detection Methods for CVE-2025-63740

Indicators of Compromise

HTTP requests to inputAction.php invoking the getselectdataAjax action with SQL metacharacters in the actstr parameter
Web server access logs showing UNION, SELECT, SLEEP, or comment sequences (--, #, /*) in actstr values
Unexpected outbound queries against RockOA user and configuration tables

Detection Strategies

Deploy web application firewall rules that flag SQL syntax in query and body parameters targeting inputAction.php
Enable database query logging and alert on unusual SELECT statements originating from the RockOA application user
Correlate authentication anomalies with prior access to getselectdataAjax endpoints

Monitoring Recommendations

Baseline normal actstr parameter values and alert on deviations in length, character set, or SQL keywords
Monitor database read volumes for the RockOA schema, particularly against tables storing administrator credentials
Retain HTTP access logs for the RockOA host to support incident response and forensic review

How to Mitigate CVE-2025-63740

Immediate Actions Required

Restrict network access to RockOA 2.7.0 instances to trusted management segments only
Place the RockOA web interface behind a web application firewall with SQL injection signatures enabled
Rotate administrator passwords and audit account activity for signs of unauthorized data access

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Track the upstream project via GitHub Issue #13 for remediation updates from the maintainer.

Workarounds

Block or filter HTTP requests to inputAction.php where the actstr parameter contains SQL metacharacters or keywords
Enforce least privilege on the database account used by RockOA to limit data reachable through injection
Disable or firewall the affected endpoint if it is not required for business operations

bash

# Example nginx location block restricting access to inputAction.php
location ~* /inputAction\.php$ {
    allow 10.0.0.0/24;    # trusted management network
    deny all;
    proxy_pass http://rockoa_backend;
}