CVE-2019-9846

RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection...

RockOA SQL Injection Vulnerability

ROCKOA Xinhuo office system is a free and open source OA collaborative office system for small and medium-sized enterprises. RockOA 1.8.7 SQL injection vulnerability exists. The vulnerability stems from the webmain/webmainAction.php publictreestore method using the pidfields and idfields paramete...

PT-2019-19894

Name of the Vulnerable Software and Affected Versions RockOA version 1.8.7 Description The issue allows remote attackers to obtain sensitive information due to the unsafe construction of a SQL WHERE clause in the webmain/webmainAction.php publictreestore method. This is achieved by exploiting the...

CVE-2019-9846: Improper Neutralization of Special Elements used in an SQL Command

RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection...