| शीर्षक | rainrocka xinhu 2.7.6 SQL Injection |
|---|
| विवरण | A vulnerability was found in rainrocka Xinhu OA v2.7.6 and classified as critical. This issue affects the getOrder method in the file webmain/webmainAction.php. The manipulation of the highorder parameter leads to a SQL injection vulnerability.
Attack Chain: publicstoreAjax -> limitRows -> getOrder -> SQL Injection.
Blacklist Bypass Details: The system utilizes iconvsql() for input sanitization, which checks for parentheses (). However, this can be bypassed by inserting a space between the function name and the opening parenthesis (e.g., using IF ( instead of IF(), allowing authenticated remote attackers to execute arbitrary SQL commands. |
|---|
| स्रोत | ⚠️ https://github.com/Bu7terf1y/cve/issues/1 |
|---|
| उपयोगकर्ता | Bu7terf1y (UID 99567) |
|---|
| सबमिशन | 06/07/2026 08:42 AM (2 महीनों पहले) |
|---|
| संयम | 01/09/2026 09:07 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397553 [Xinhu Rainrock RockOA तक 2.7.6 webmainAction.php getOrder highorder SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|