| Titel | RockOA 2.7.6 SQL Injection |
|---|
| Beschreibung | Title
Xinhu OA 2.7.6 openkqj API Unauthenticated SQL Injection
Vulnerability Description
Xinhu OA 2.7.6 does not enforce the configured OpenAPI key or an equivalent device signature in the openkqj action. The action-specific initialization in webmain/task/openapi/openkqjAction.php overrides the parent initialization path and does not perform the normal openkey validation.
After a request reaches the attendance-device callback handler, the JSON value in return[].id is passed to kqjcmdModel::returnchuli() and concatenated into SQL conditions, including conditions equivalent to:
`id`=$mid
and:
`id` in($mids)
The value is not converted to an integer and is not bound through a prepared statement. Consequently, an unauthenticated remote attacker who knows a valid sn can inject SQL through the attendance-device callback and alter the state of attendance-device command records. The broader confidentiality, integrity, and availability impact depends on the database account and the resulting SQL context.
Affected Code
webmain/task/openapi/openkqjAction.php:9-13
webmain/task/openapi/openkqjAction.php:21-66
webmain/model/kqjcmdModel.php:271-338
webmain/model/kqjcmdModel.php:342-395
Proof of Concept
The following request was sent without an authentication cookie or OpenAPI key. labtest was a test device created for the authorized lab and is not evidence that arbitrary deployments expose a device number.
POST /api.php/openkqj/api/post?sn=<VALID_DEVICE_SN> HTTP/1.1
Host: <AUTHORIZED_LAB_HOST>
Content-Type: application/json
Connection: close
[{"id":"sqli-or","data":"return","return":[{"id":"0 OR 1=1","result":"1"}]}]
The application returned a successful callback result. A subsequent unauthenticated device-command retrieval request showed that the injected condition matched and changed the state of the test command records:
GET /api.php/openkqj/api/get?sn=<VALID_DEVICE_SN> HTTP/1.1
Host: <AUTHORIZED_LAB_HOST>
Connection: close
This PoC demonstrates SQL injection and unauthorized state modification only. No database dump, destructive query, or production data modification was performed.
Impact
Unauthorized modification of attendance-device command state.
Potential SQL-level disclosure or modification of application data, depending on database permissions and query context.
The missing device-level authentication increases the reachability of the injection when a valid sn is exposed through deployment data, logs, device configuration, or another information-disclosure issue.
Remediation
Restore OpenAPI authentication and require a per-device secret or signature for every openkqj callback.
Parse return[].id as an integer identifier and reject non-integer values.
Replace string-concatenated SQL with prepared statements and parameter binding.
Bind each returned command ID as a separate typed parameter rather than constructing an IN expression from client input.
Log and rate-limit failed device authentication attempts.
References
Official project repository: https://github.com/rainrocka/xinhu
|
|---|
| Benutzer | BlackSpdier (UID 89912) |
|---|
| Einreichung | 01.09.2026 04:13 (vor 1 Monat) |
|---|
| Moderieren | 10.10.2026 17:17 (1 month later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 416228 [Xinhu Rainrock RockOA bis 2.7.6 Openkqj Action openkqjAction.php kqjcmdModel::returnchuli id SQL Injection] |
|---|
| Punkte | 17 |
|---|