| Título | xinhu xinhuOA 2.3.2 SQL Injection |
|---|
| Descripción | A time-based blind SQL injection vulnerability exists in the /index.php?m=index&a=publicsavevalue&ajaxbool=true endpoint of Xinhu OA (RockOA) version 2.3.2. An authenticated attacker with only regular user privileges can inject malicious SQL code through the value parameter by using the (&;) prefix to bypass security protections.
Technical Details
The value parameter undergoes minimal filtering (only single-quote escaping and a keyword blacklist) before being passed to the toaddval() function. When toaddval() detects that the value starts with (&;), it strips this prefix and inserts the remaining content as a "raw value" directly into the SQL statement without enclosing it in single quotes. This allows attackers to inject arbitrary SQL fragments.
Exploitation
By injecting payloads such as:
1 AND BENCHMARK(38000000,MD5(1))--
attackers can leverage the BENCHMARK() function (which is not blocked by the blacklist, unlike SLEEP()) to create measurable time delays. The -- comment operator discards the original WHERE clause, ensuring the injected code executes.
Impact
Data exfiltration: Extract sensitive data (e.g., administrator passwords) character by character via time-based blind inference.
Data tampering: Modify arbitrary fields in any table due to the UPDATE statement context.
Access: Requires only a valid login session (no special privileges needed).
Root Cause
Insufficient input validation on the value parameter, combined with the dangerous (&;) raw-value handling mechanism in toaddval(), allows un-sanitized user input to be directly concatenated into SQL queries without prepared statements or parameterized queries. |
|---|
| Fuente | ⚠️ https://github.com/jennfong2002-png/CVE/issues/1 |
|---|
| Usuario | jenn02 (UID 99617) |
|---|
| Sumisión | 2026-07-08 03:45 (hace 2 meses) |
|---|
| Moderación | 2026-09-01 09:48 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 397559 [Xinhu Rainrock RockOA hasta 2.3.2 index.php?m=index&a=publicsavevalue&ajaxbool=true toaddval Valor inyección SQL] |
|---|
| Puntos | 20 |
|---|