提出 #882653: xinhu xinhuOA 2.3.2 SQL Injection

A time-based blind SQL injection vulnerability exists in the /index.php?m=index&a=publicsavevalue&ajaxbool=true endpoint of Xinhu OA (RockOA) version 2.3.2. An authenticated attacker with only regular user privileges can inject malicious SQL code through the value parameter by using the (&;) prefix to bypass security protections.

Technical Details

The value parameter undergoes minimal filtering (only single-quote escaping and a keyword blacklist) before being passed to the toaddval() function. When toaddval() detects that the value starts with (&;), it strips this prefix and inserts the remaining content as a "raw value" directly into the SQL statement without enclosing it in single quotes. This allows attackers to inject arbitrary SQL fragments.

Exploitation

By injecting payloads such as:

1 AND BENCHMARK(38000000,MD5(1))--
attackers can leverage the BENCHMARK() function (which is not blocked by the blacklist, unlike SLEEP()) to create measurable time delays. The -- comment operator discards the original WHERE clause, ensuring the injected code executes.
Impact

Data exfiltration: Extract sensitive data (e.g., administrator passwords) character by character via time-based blind inference.

Data tampering: Modify arbitrary fields in any table due to the UPDATE statement context.

Access: Requires only a valid login session (no special privileges needed).

Root Cause

Insufficient input validation on the value parameter, combined with the dangerous (&;) raw-value handling mechanism in toaddval(), allows un-sanitized user input to be directly concatenated into SQL queries without prepared statements or parameterized queries.

• ソース: ⚠️ https://github.com/jennfong2002-png/CVE/issues/1
• ユーザー: jenn02 (UID 99617)
• 送信: 2026年07月08日 03:45 (2 月 ago)
• モデレーション: 2026年09月01日 09:48 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 397559 [Xinhu Rainrock RockOA 迄 2.3.2 index.php?m=index&a=publicsavevalue&ajaxbool=true toaddval 値 SQLインジェクション]
• ポイント: 20