CVE-2019-9846

RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection...

RockOA SQL Injection Vulnerability

ROCKOA Xinhuo office system is a free and open source OA collaborative office system for small and medium-sized enterprises. RockOA 1.8.7 SQL injection vulnerability exists. The vulnerability stems from the webmain/webmainAction.php publictreestore method using the pidfields and idfields paramete...