CVE-2019-9846

RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection...

CVE-2019-9846

RockOA 1.8.7 is affected by a SQL injection in webmain/webmainAction.php (publictreestore) where the code unsafely uses pidfields and idfields to build a SQL WHERE clause. This causes background SQL injection and can let remote attackers obtain sensitive information. Evidence across multiple sour...