提交 #882653: xinhu xinhuOA 2.3.2 SQL Injection

A time-based blind SQL injection vulnerability exists in the /index.php?m=index&a=publicsavevalue&ajaxbool=true endpoint of Xinhu OA (RockOA) version 2.3.2. An authenticated attacker with only regular user privileges can inject malicious SQL code through the value parameter by using the (&;) prefix to bypass security protections.

Technical Details

The value parameter undergoes minimal filtering (only single-quote escaping and a keyword blacklist) before being passed to the toaddval() function. When toaddval() detects that the value starts with (&;), it strips this prefix and inserts the remaining content as a "raw value" directly into the SQL statement without enclosing it in single quotes. This allows attackers to inject arbitrary SQL fragments.

Exploitation

By injecting payloads such as:

1 AND BENCHMARK(38000000,MD5(1))--
attackers can leverage the BENCHMARK() function (which is not blocked by the blacklist, unlike SLEEP()) to create measurable time delays. The -- comment operator discards the original WHERE clause, ensuring the injected code executes.
Impact

Data exfiltration: Extract sensitive data (e.g., administrator passwords) character by character via time-based blind inference.

Data tampering: Modify arbitrary fields in any table due to the UPDATE statement context.

Access: Requires only a valid login session (no special privileges needed).

Root Cause

Insufficient input validation on the value parameter, combined with the dangerous (&;) raw-value handling mechanism in toaddval(), allows un-sanitized user input to be directly concatenated into SQL queries without prepared statements or parameterized queries.

• 来源: ⚠️ https://github.com/jennfong2002-png/CVE/issues/1
• 用户: jenn02 (UID 99617)
• 提交: 2026-07-08 03時45分 (2 月前)
• 管理: 2026-09-01 09時48分 (2 months later)
• 状态: 已接受
• VulDB条目: 397559 [Xinhu Rainrock RockOA 直到 2.3.2 index.php?m=index&a=publicsavevalue&ajaxbool=true toaddval 值 SQL注入]
• 积分: 20