CVE-2025-63740

Xinhu Rainrock RockOA version 2.7.0 is vulnerable to a SQL Injection flaw in the getselectdataAjax function located in the inputAction.php file. The root cause is the incorrect operation of the actstr parameter, which allows an attacker to extract sensitive information such as administrator accou...

CVE-2025-63740

SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the actstr parameter...