CVE-2019-9846: Improper Neutralization of Special Elements used in an SQL Command

RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection...

PT-2019-19894

Name of the Vulnerable Software and Affected Versions RockOA version 1.8.7 Description The issue allows remote attackers to obtain sensitive information due to the unsafe construction of a SQL WHERE clause in the webmain/webmainAction.php publictreestore method. This is achieved by exploiting the...