SQL Injection Vulnerability in Xinhu RockOA Web Application

CVE-2024-7327

What is CVE-2024-7327?

A serious vulnerability has been identified in the Xinhu RockOA web application, specifically affecting version 2.6.2. This flaw exists within the dataAction function of the script located at /webmain/task/openapi/openmodhetongAction.php. An attacker can exploit this vulnerability by manipulating the nickName parameter, resulting in SQL injection. Such an attack could allow unauthorized access to sensitive data within the database, leading to data breaches or information theft. The vulnerability has been disclosed publicly, and there has been a lack of response from the vendor regarding security measures. Organizations using this application are advised to take immediate action to secure their systems against potential exploitation.

References