| Titre | xinhu xinhuOA 2.3.2 SQL Injection |
|---|
| Description | A time-based blind SQL injection vulnerability exists in the /index.php?m=index&a=publicsavevalue&ajaxbool=true endpoint of Xinhu OA (RockOA) version 2.3.2. An authenticated attacker with only regular user privileges can inject malicious SQL code through the value parameter by using the (&;) prefix to bypass security protections.
Technical Details
The value parameter undergoes minimal filtering (only single-quote escaping and a keyword blacklist) before being passed to the toaddval() function. When toaddval() detects that the value starts with (&;), it strips this prefix and inserts the remaining content as a "raw value" directly into the SQL statement without enclosing it in single quotes. This allows attackers to inject arbitrary SQL fragments.
Exploitation
By injecting payloads such as:
1 AND BENCHMARK(38000000,MD5(1))--
attackers can leverage the BENCHMARK() function (which is not blocked by the blacklist, unlike SLEEP()) to create measurable time delays. The -- comment operator discards the original WHERE clause, ensuring the injected code executes.
Impact
Data exfiltration: Extract sensitive data (e.g., administrator passwords) character by character via time-based blind inference.
Data tampering: Modify arbitrary fields in any table due to the UPDATE statement context.
Access: Requires only a valid login session (no special privileges needed).
Root Cause
Insufficient input validation on the value parameter, combined with the dangerous (&;) raw-value handling mechanism in toaddval(), allows un-sanitized user input to be directly concatenated into SQL queries without prepared statements or parameterized queries. |
|---|
| La source | ⚠️ https://github.com/jennfong2002-png/CVE/issues/1 |
|---|
| Utilisateur | jenn02 (UID 99617) |
|---|
| Soumission | 08/07/2026 03:45 (il y a 2 mois) |
|---|
| Modérer | 01/09/2026 09:48 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 397559 [Xinhu Rainrock RockOA jusqu’à 2.3.2 index.php?m=index&a=publicsavevalue&ajaxbool=true toaddval Valeur injection SQL] |
|---|
| Points | 20 |
|---|