CVE-2026-84153: Xinhu Rainrock RockOA SQL Injection Flaw

CVE-2026-84153 Overview

CVE-2026-84153 is a SQL injection vulnerability in Xinhu Rainrock RockOA through version 2.3.2. The flaw resides in the toaddval function within /index.php?m=index&a=publicsavevalue&ajaxbool=true. An authenticated remote attacker can manipulate the Value parameter to inject arbitrary SQL statements against the backend database. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output). Public exploit details have been disclosed, and the vendor did not respond to disclosure attempts. Because RockOA is deployed as an office automation platform, successful exploitation can expose organizational records, user credentials, and internal business data.

Critical Impact
Remote authenticated attackers can execute arbitrary SQL against RockOA databases through the Value parameter, leading to unauthorized read and write access to stored records.

Affected Products

Xinhu Rainrock RockOA versions up to and including 2.3.2
Deployments exposing /index.php?m=index&a=publicsavevalue&ajaxbool=true endpoint
Instances running the vulnerable toaddval function

Discovery Timeline

2026-09-01 - CVE-2026-84153 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84153

Vulnerability Analysis

The vulnerability exists in the toaddval function handling requests to /index.php?m=index&a=publicsavevalue&ajaxbool=true. The Value argument is passed to a database query without adequate neutralization of SQL metacharacters. An attacker with valid low-privilege session credentials can submit crafted input that alters the intended query structure. The result is arbitrary SQL execution within the RockOA database context.

Because the endpoint accepts remote requests, exploitation does not require local access or user interaction beyond initial authentication. Attackers can enumerate database contents, extract sensitive records, or modify persistent data. The public disclosure of the exploit lowers the barrier to weaponization.

Root Cause

The root cause is the absence of parameterized queries or input sanitization on the Value argument inside the toaddval function. User-supplied data is concatenated into SQL statements executed against the backend. This pattern maps directly to [CWE-74], which covers improper neutralization of special elements in downstream components.

Attack Vector

The attack originates from the network against an authenticated session. An attacker sends a POST or GET request to /index.php?m=index&a=publicsavevalue&ajaxbool=true with a malicious Value payload. The injected SQL fragment executes with the privileges of the RockOA database user. No local access, elevated privileges, or user interaction is required beyond the initial low-privilege login.

Exploitation techniques described in the public disclosure focus on manipulating the Value parameter. See the GitHub CVE Issue Tracker and VulDB Vulnerability Details for the technical write-up.

Detection Methods for CVE-2026-84153

Indicators of Compromise

HTTP requests to /index.php?m=index&a=publicsavevalue&ajaxbool=true containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment sequences in the Value parameter
Unexpected database errors or elevated query volume from the RockOA application user
Session activity from low-privilege accounts issuing repeated requests to the publicsavevalue action

Detection Strategies

Deploy web application firewall signatures that flag SQL injection patterns targeting the Value parameter on the publicsavevalue endpoint
Correlate authentication logs with anomalous access to toaddval handler activity for the same session
Review database query logs for statements originating from the RockOA account that deviate from application baselines

Monitoring Recommendations

Enable verbose HTTP request logging on the RockOA web tier, retaining full URI and body content for the publicsavevalue action
Alert on database error responses returned to authenticated user sessions
Monitor outbound network activity from the RockOA host for exfiltration attempts following suspicious query bursts

How to Mitigate CVE-2026-84153

Immediate Actions Required

Restrict access to the RockOA application to trusted networks and authenticated internal users only
Audit RockOA user accounts and revoke unnecessary low-privilege access that could be leveraged for exploitation
Deploy WAF rules that block SQL metacharacters in the Value parameter of the publicsavevalue endpoint
Review database and application logs for prior exploitation activity against the affected endpoint

Patch Information

As of publication, the vendor Xinhu has not responded to disclosure and no official patch is available. Organizations should track the VulDB CVE Entry and the GitHub CVE Issue Tracker for vendor updates. Until a fix is released, apply compensating controls at the network and application layers.

Workarounds

Place RockOA behind a reverse proxy with strict input validation rules that reject SQL syntax in request parameters
Enforce least-privilege database accounts so the RockOA application user cannot read or modify data outside its required tables
Disable or restrict the publicsavevalue action at the web server level if it is not required for business operations
Isolate the RockOA instance on a segmented network and require VPN access for administration

bash

# Example Nginx configuration to block SQL metacharacters on the vulnerable endpoint
location ~* /index\.php {
    if ($args ~* "m=index&a=publicsavevalue") {
        if ($request_body ~* "(union|select|sleep|--|';)") {
            return 403;
        }
    }
}