Xinhu RainrockOA, versions up to 2.7.6, contain a flaw in the function kqjcmdModel::returnchuli within openkqjAction.php. Manipulating the ID argument allows the construction of malicious SQL statements that can be executed by the underlying database engine. This remote vulnerability can be exploited without authentication and may lead to unauthorized read, update, or deletion of application data, potentially exposing sensitive information or altering critical business records.

The vulnerability affects systems running Xinhu:Rainrock RockOA, specifically all releases up to and including version 2.7.6. Products newer than 2.7.6 are not impacted. No other vendors or products are listed as affected.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available, so the precise likelihood of exploitation is uncertain. The vulnerability is listed as not in the CISA KEV catalog, but a public exploit is available. Attackers can reach the vulnerable endpoint remotely, so the primary risk surfaces over the network. Without a vendor patch, the risk remains significant until mitigations are applied.