CVE-2026-108571

Executive Summary

CVE-2026-108571 is an unauthenticated SQL injection vulnerability in Xinhu Rainrock RockOA versions up to 2.7.6, reachable through the Openkqj Action component. The flaw resides in the kqjcmdModel::returnchuli function within webmain/task/openapi/openkqjAction.php, where manipulation of the ID argument allows an attacker to inject SQL. Because the attack is network-reachable and requires no privileges or user interaction, any internet-exposed RockOA instance matching the affected version range is at risk of data theft, integrity tampering, and potential downstream compromise.

Technical Analysis

The vulnerability class is SQL injection (CWE-74, improper neutralization of special elements used in an SQL command / injection). According to the NVD description, the specific entry point is the ID argument processed by the function kqjcmdModel::returnchuli in the file webmain/task/openapi/openkqjAction.php, part of the Openkqj Action component. The description states that manipulation of this argument causes SQL injection and that the attack is remotely exploitable.

The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3) indicates a network-accessible vulnerability with low attack complexity, no privileges required, and no user interaction. All three CIA impacts are rated Low, and scope is Unchanged, meaning the vulnerable component and any impacted resources share the same security authority. The low complexity and zero-privilege requirements materially lower the barrier to exploitation.

No public proof-of-concept code, Nuclei template, or exploit code is listed in the provided intelligence data, although the NVD description states that an exploit has been made available to the public. Because the description does not disclose the precise SQL construction, parameter binding status, or backend database engine, the exact injection syntax cannot be confirmed from the available data. No specific query structure, database type, or sanitization routine should be inferred beyond what is stated.

The Openkqj Action endpoint is exposed under the openapi path segment, suggesting an API-style handler intended for external or integration-driven access. Such handlers frequently receive structured parameters (here, ID) and may process them without adequate prepared-statement usage. The disclosure timeline notes the vendor was contacted early but did not respond, leaving the defect unaddressed as of this report.

Exploitation Scenarios

No public PoC is confirmed in the supplied data; the following chain is inferred strictly at the vulnerability-class level from the NVD description.

1. Reconnaissance / target identification. An attacker scans for internet-exposed Xinhu Rainrock RockOA deployments, identifying instances that expose the Openkqj Action endpoint associated with webmain/task/openapi/openkqjAction.php. Fingerprinting relies on the presence of the RockOA application and its openapi task handlers.

2. Triggering the flaw class. The attacker submits a crafted request to the Openkqj Action component in which the ID argument is manipulated. Because the function kqjcmdModel::returnchuli passes this argument into SQL without adequate neutralization, the injected content alters the executed query. Per the NVD description, no authentication is required, so the request can be issued directly.

3. Payload / execution method. At the vulnerability-class level, the attacker supplies SQL syntax within the ID parameter to influence query logic — for example, to alter result sets, bypass conditions, or append additional clauses. The precise payload grammar is not specified in the available data and must not be assumed. Delivery is remote over the network via the exposed endpoint.

4. Post-exploitation impact. Successful injection can yield unauthorized read access to backend data (confidentiality, Low per CVSS), modification or deletion of records (integrity, Low), and resource exhaustion or query disruption (availability, Low). Depending on database permissions and configuration, injection may serve as a stepping stone for further data extraction or lateral movement, though the CVSS scope is rated Unchanged.

Impact Assessment

Affected systems are Xinhu Rainrock RockOA deployments up to and including version 2.7.6 that expose the Openkqj Action endpoint. The CVSS base score of 7.3 (High) reflects a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction. The Low Confidentiality, Integrity, and Availability subscores bound the direct impact per request, but repeated exploitation can aggregate into significant data exposure or record tampering across the backend database. Because the endpoint is unauthenticated and remotely reachable, the blast radius includes any RockOA instance reachable from attacker-controlled networks, including those exposed directly to the internet. Public availability of an exploit increases the likelihood of opportunistic scanning and automated attacks. Business impact centers on leakage of workflow, HR, or administrative records commonly stored by OA platforms, plus trust and compliance exposure. No evidence of CISA KEV listing or confirmed in-the-wild campaigns is present in the provided data.

Detection Guidance

Sigma Rule

title: Xinhu RockOA Openkqj Action SQL Injection Attempt (CVE-2026-108571)
id: 7c1f2a94-1b6e-4d5a-9f3e-0a2c4b6d8e10
status: experimental
description: Detects SQL injection attempts against the Openkqj Action endpoint via the ID argument in Xinhu Rainrock RockOA.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108571
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains: 'openkqjAction'
  selection_payload:
    cs-uri-query|contains:
      - 'union'
      - 'select'
      - 'sleep('
      - 'benchmark('
      - 'extractvalue('
      - 'updatexml('
      - "' or "
      - '%27'
  condition: selection_path and selection_payload
falsepositives:
  - Legitimate application parameters containing SQL keywords
level: high

YARA Rule

rule CVE_2026_108571_RockOA_SQLi_Request
{
    meta:
        description = "Detects SQL injection payloads targeting Xinhu RockOA Openkqj Action endpoint"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108571"
        author = "valtersit.com"
        date = "2026-01-01"
    strings:
        $endpoint = "openkqjAction" ascii nocase
        $file = "openkqjAction.php" ascii nocase
        $p1 = "union" ascii nocase
        $p2 = "select" ascii nocase
        $p3 = "sleep(" ascii nocase
        $p4 = "benchmark(" ascii nocase
        $p5 = "extractvalue(" ascii nocase
        $p6 = "updatexml(" ascii nocase
        $id = "ID=" ascii nocase
    condition:
        ($endpoint or $file) and $id and any of ($p*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108571 Xinhu RockOA Openkqj Action SQL Injection Attempt"; flow:to_server,established; http.uri; content:"openkqjAction"; nocase; http.uri; content:"ID"; nocase; pcre:"/(union[\s\S]{0,20}select|sleep\(|benchmark\(|extractvalue\(|updatexml\()/iU"; reference:cve,2026-108571; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108571; classtype:web-application-attack; sid:2026108571; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "GET" or http.request.method == "POST" ]
  [ url where url.path contains "openkqjAction" and
      (url.query contains "union" or url.query contains "select" or
       url.query contains "sleep(" or url.query contains "benchmark(" or
       url.query contains "extractvalue(" or url.query contains "updatexml(") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=*nginx* OR sourcetype=*apache*
| eval uri_raw = coalesce(uri, url, cs_uri_stem)
| where match(uri_raw, "(?i)openkqjAction")
| eval q = coalesce(uri_query, url, cs_uri_query)
| where match(q, "(?i)(union\s+select|sleep\(|benchmark\(|extractvalue\(|updatexml\(|'\s+or\s+)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, host, uri_raw
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,sqli,">
  <rule id="108571" level="12">
    <if_sid>31100,31101,31108</if_sid>
    <url>openkqjAction</url>
    <regex type="pcre2">(?i)(union\s+select|sleep\(|benchmark\(|extractvalue\(|updatexml\(|'\s+or\s+)</regex>
    <description>CVE-2026-108571: SQL injection attempt against Xinhu RockOA Openkqj Action endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sqli,pci_dss_6.5.1,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict or block network access to the Openkqj Action endpoint (webmain/task/openapi/openkqjAction.php) using a reverse proxy, WAF, or firewall rule until a fix is available. Apply strict allow-listing on the ID argument (numeric-only validation) at the edge where feasible, and enable logging for all requests to the endpoint to support detection and forensics. Given the vendor's non-response, treat the deployment as permanently exposed until remediated by other means.

2. Patch / upgrade steps. No vendor patch is available and no fixed version has been identified. Monitor the vendor (Xinhu Rainrock RockOA) for an advisory or updated release. Because the disclosed function kqjcmdModel::returnchuli accepts the ID argument directly, organizations with in-house capability may review the source and replace string concatenation with parameterized queries, but this is a custom remediation, not a vendor-supplied fix. If the software is not business-critical and remains unpatched, consider replacement with a supported platform.

3. Long-term hardening. Deploy parameterized queries/prepared statements across all handlers, enforce input validation on all API-style parameters, apply least-privilege database accounts to limit injection impact, segment OA applications from the public internet behind authenticated gateways, and maintain continuous vulnerability scanning with WAF signatures for SQL injection. Establish a vendor risk process for products whose maintainers do not respond to security disclosures.

References

• NVD — CVE-2026-108571: https://nvd.nist.gov/vuln/detail/CVE-2026-108571
• CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component): https://cwe.mitre.org/data/definitions/74.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (not yet scored at time of writing): https://www.first.org/epss/
• Vendor project page (Xinhu Rainrock RockOA) — no vendor advisory available; vendor did not respond to disclosure. No CISA KEV listing; no confirmed threat actor campaigns or in-the-wild exploitation evidence in provided data.