The flaw exists in the toaddval function, specifically invoked through /index.php?m=index&a=publicsavevalue&ajaxbool=true. When a specially crafted request is sent, the Value argument is directly incorporated into an SQL statement without proper sanitization, enabling an attacker to inject arbitrary SQL commands. The effect is a loss of data integrity, potential data exposure, and possible modification of database contents. The issue falls under CWE‑74 (Untrusted Search Path) and CWE‑89 (SQL Injection).

The vulnerability affects Xinhu Rainrock RockOA releases up to version 2.3.2. No specific sub‑versions are listed beyond this upper bound; all installations running 2.3.2 or earlier are considered vulnerable. The application is typically deployed in enterprise intranets or on public servers, and the affected component is the publicsavevalue endpoint exposed via index.php.

The public disclosure indicates that an exploitation method has been demonstrated; the attack can be carried out remotely without needing administrative access. The CVSS score of 5.3 places the flaw in the medium severity range. EPSS information is not available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog, but the known remote nature of the attack and the lack of a vendor response elevate the need for immediate action.