CVE-2026-108571: Unauthenticated SQL Injection in Xinhu Rainrock RockOA

Overview

A SQL injection vulnerability tracked as CVE-2026-108571 has been disclosed in Xinhu Rainrock RockOA, a Chinese office-automation (OA) platform used by enterprises for internal workflow, approvals, and attendance management. The flaw affects RockOA versions 2.7.0 through 2.7.6 (≤ 2.7.6) and allows a remote attacker to inject malicious SQL through the ID parameter of the product's Openkqj Action OpenAPI component.

The issue was reserved on 2026-10-10 and published on 2026-10-11, carrying a CVSS 3.1 score of 7.3 (High). According to multiple trackers, Xinhu was contacted early about the disclosure but did not respond, and no official patch has been released as of this writing.

Technical Details

Note: automated scoring aggregators disagree slightly on the CVSS v4.0 equivalent (figures from 5.5 to 6.9 have been reported by different trackers). CosmicBytez Labs treats the CVSS v3.1 score of 7.3 published alongside the CVE record as authoritative for this advisory.

How It Works

RockOA's Openkqj Action component exposes an OpenAPI task endpoint backed by webmain/task/openapi/openkqjAction.php. Within that file, the kqjcmdModel::returnchuli function accepts an ID argument and uses it to build a database query. Because the value is concatenated into the SQL statement without parameterization or sufficient input validation, an attacker can manipulate the ID argument to alter the query's logic — the textbook pattern behind CWE-89 (SQL Injection).

Multiple sources describing the flaw note that exploitation is considered easy: the endpoint can be reached over the network, requires no authentication, no user interaction, and only low attack complexity. That combination — an unauthenticated, remotely reachable OpenAPI endpoint with an unsanitized identifier parameter — is what drives the CVSS 3.1 impact to confidentiality, integrity, and availability (each rated Low individually, but combined they add up to a High-severity finding).

Attack Chain

1. Discovery — Attacker identifies an internet- or intranet-reachable RockOA instance running a vulnerable version (≤ 2.7.6).
2. Endpoint targeting — Attacker locates the Openkqj Action OpenAPI task endpoint (openkqjAction.php) exposed by the application.
3. Injection — Attacker submits a crafted ID parameter containing SQL metacharacters or UNION-based payloads.
4. Query manipulation — The unsanitized value reaches kqjcmdModel::returnchuli and alters the backend SQL query executed against RockOA's database.
5. Data exposure / tampering — Depending on the underlying schema and database privileges, the attacker can read, modify, or disrupt data tied to the OA platform's task/attendance records and potentially pivot to other stored data.

Impact Assessment

Who Is at Risk

• Organizations running Xinhu Rainrock RockOA 2.7.0 through 2.7.6, particularly instances where the OpenAPI task interface is reachable from outside a trusted internal network
• Deployments that rely solely on RockOA's built-in access controls rather than network-level restrictions in front of OpenAPI endpoints
• Any environment where RockOA stores sensitive HR, attendance, approval, or workflow data that would be damaging if exposed or tampered with

Recommendations

For System Administrators

• Restrict network exposure of RockOA's OpenAPI endpoints (including webmain/task/openapi/openkqjAction.php) to trusted internal IP ranges or a VPN; do not expose the OpenAPI task interface directly to the internet.
• Apply vendor updates immediately once Xinhu publishes a fix — track the CVE record for a patched release, since none is confirmed at this time.
• Place a WAF or reverse-proxy rule in front of the OpenAPI endpoint to block common SQL injection patterns (UNION SELECT, stacked queries, comment terminators) in the ID parameter as an interim compensating control.

For Security Teams

• Audit database privileges used by the RockOA application account; limit it to the minimum required for OA operations so a successful injection has a smaller blast radius.
• Monitor logs for anomalous requests to openkqjAction.php or unusual values in the ID parameter, including SQL metacharacters (', --, UNION, OR 1=1).
• Track vendor communications — since Xinhu has not responded to disclosure outreach, security teams should not assume a timely patch and should plan compensating controls accordingly.

For End Users

• Report any unexpected OA system behavior (missing records, altered task/attendance data, unusual slow responses) to your IT/security team promptly, as these can be symptoms of injection abuse.
• Avoid accessing RockOA instances over untrusted or public networks until network-level restrictions are confirmed to be in place.

Background

Xinhu Rainrock RockOA is an office-automation platform used by organizations to manage internal workflow, task assignment, approvals, and attendance. OpenAPI-style task modules — like the Openkqj Action component affected here — are commonly used to integrate RockOA with other internal systems, which also makes them an attractive remote attack surface when input handling is weak. RockOA has a history of disclosed SQL injection issues in other components, suggesting input validation gaps may extend beyond this single endpoint.

Key Takeaways

1. CVE-2026-108571 is a CVSS 7.3 (High) SQL injection in Xinhu Rainrock RockOA, affecting versions 2.7.0 through 2.7.6.
2. The flaw lives in kqjcmdModel::returnchuli within webmain/task/openapi/openkqjAction.php, where the ID parameter is not safely handled before reaching a SQL query.
3. Exploitation requires no authentication and no user interaction, and is reachable remotely over the network.
4. No official patch is available, and the vendor did not respond to early disclosure contact — organizations must rely on network restrictions and WAF rules as interim mitigations.
5. A public proof-of-concept has reportedly circulated according to multiple trackers, increasing urgency for affected organizations to restrict access immediately.
6. RockOA deployments should treat all OpenAPI task endpoints as sensitive attack surface and apply least-privilege database access as defense-in-depth.

Sources

• NVD — CVE-2026-108571
• VulDB — CVE-2026-108571
• OffSeq Threat Radar — CVE-2026-108571: SQL Injection in Xinhu Rainrock RockOA
• Strix.ai — CVE-2026-108571: Rainrock RockOA Injection