SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive informa…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Dec 9, 2025 · NIST NVD

   Detected

   SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters.

2. Oct 14, 2026 · NIST NVD

   Updated

   SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters.

Affected

• cpe rockoa/rockoa2.7.0

Sources

• CVE.orgVulnerability recordCVE-2025-63742

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-63742

  30-day exploitation probability 0.4%

  first.org
• NIST NVDVulnerability recordCVE-2025-63742

  SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shou

  nvd.nist.gov

References

• Exploit · github.com