Xinhu Rainrock · Rockoa · CVE-2026-84109
**Name of the Vulnerable Software and Affected Versions**
Xinhu Rainrock RockOA versions prior to 2.7.7
**Description**
A remote SQL injection exists in the `getOrder()` function within the `webmain/webmainAction.php` file. This issue occurs when the `highorder` argument is manipulated, allowing an attacker to execute unauthorized database queries.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
As a temporary workaround, restrict access to the `getOrder()` function in the `webmain/webmainAction.php` file to minimize the risk of exploitation.