CVE-2026-84153

Executive Summary

CVE-2026-84153 is a SQL injection vulnerability in Xinhu Rainrock RockOA up to version 2.3.2, affecting the toaddval function within the publicsavevalue endpoint. An authenticated remote attacker with low-privilege user access can manipulate the Value argument to inject arbitrary SQL queries, potentially leading to unauthorized data access, data modification, or partial system compromise. The vendor was contacted but has not responded, resulting in a patch confidence rating of 0/4 — the vulnerability remains unpatched across all supported deployments.

Technical Analysis

The vulnerability exists in Xinhu Rainrock RockOA, a web-based office automation (OA) platform used for enterprise collaboration, document management, and workflow automation. The affected element is the toaddval function within the file /index.php?m=index&a=publicsavevalue&ajaxbool=true.

The impacted endpoint processes AJAX requests from authenticated users. The Value argument passed to the toaddval function is concatenated or interpolated into a SQL statement without adequate parameterization or sanitization. This failure to neutralize special SQL elements (CWE-74) permits an attacker to terminate the intended SQL statement and append malicious SQL fragments.

The attack vector is network-based (AV:N) with low attack complexity (AC:L). Exploitation requires a valid low-privilege account (PR:L), meaning the attacker must already possess legitimate credentials such as a standard employee or operator account within the OA platform. No user interaction is required (UI:N), and the authorization impact is mapped to Partial (CWE-74 chained with SQL injection capabilities), yielding a CVSS score of 6.3.

Functionally, the toaddval function likely handles persisting or updating user-supplied values (such as user preferences, form data, or dynamic field values) through a generic key-value storage mechanism. The Value parameter accepts arbitrary input strings. Because the function builds a SQL INSERT, UPDATE, or SELECT query dynamically without using prepared statements or parameterized queries, an attacker can inject single-quote characters and SQL keywords (e.g., ' OR '1'='1, ; DROP TABLE, UNION SELECT) into the query.

The fact that the exploit has been publicly disclosed suggests that technical details or example payloads exist in public repositories, forums, or security research publications. However, no official PoC repository or Nuclei template was identified in the provided data, nor has the vendor issued a security advisory acknowledging the issue.

Insufficient technical detail is available in the NVD description to confirm whether the injection occurs in a WHERE clause, INSERT statement, or dynamic query builder. However, the vulnerability class (SQL injection via unsanitized user input in a web endpoint) is well-understood and independently verifiable through testing.

Exploitation Scenarios

The attack chain for CVE-2026-84153 proceeds as follows:

Step 1 — Reconnaissance / Target Identification: An attacker identifies Rainrock RockOA deployments by scanning for the application's login page, characteristic headers, or default ports. Shodan queries such as http.title:"Rainrock" or body:"index.php?m=index&a=publicsavevalue" can surface exposed instances. The attacker then enumerates the target's registered user accounts through common username lists or by analyzing application behavior during the password-reset flow.

Step 2 — Initial Access / Authentication: Since the CVSS vector requires low privileges (PR:L), the attacker must obtain valid credentials. Common approaches include credential stuffing against the login form, dictionary attacks on default accounts, or harvesting credentials from previous breaches involving the same organization. The attacker logs in using the compromised low-privilege account.

Step 3 — Triggering the SQL Injection: With a valid session, the attacker sends a crafted HTTP request to the vulnerable endpoint:

POST /index.php?m=index&a=publicsavevalue&ajaxbool=true HTTP/1.1
Host: target
Cookie: [session cookie]

Value=payload

The Value parameter is the injection point. The attacker embeds a single quote followed by SQL payload content — for example, Value=1' AND (SELECT 1 FROM (SELECT SLEEP(5))a)-- - for time-based blind injection, or Value=1' UNION SELECT username,password FROM user-- - for data extraction.

Step 4 — Post-Exploitation Impact: Once injection is confirmed, the attacker can enumerate database schema, dump credential hashes or plaintext passwords (depending on storage), modify stored preference values to escalate privileges (if user-level data is writable via this endpoint), or extract sensitive business documents and workflow data from the OA database. Depending on the database user privileges, the attacker may also be able to write files to the web root (via INTO OUTFILE) to achieve remote code execution, though this is not confirmed by the provided NVD data.

It is acceptable to note: No public PoC was identified in the provided dataset; this attack chain is inferred from the SQL injection vulnerability class and the CVSS vector details.

Impact Assessment

Business Impact: Rainrock RockOA is deployed as a central enterprise collaboration platform. Successful exploitation allows a low-privilege user to read, modify, or delete data stored in the application database. The confidentiality impact (C:L) permits unauthorized read access to sensitive records, including internal communications, approval workflows, personnel data, and financial documents. The integrity impact (I:L) allows the attacker to tamper with stored values — potentially altering user roles, resetting administrative conditions, or poisoning data used in downstream processes.

Affected Systems: All Xinhu Rainrock RockOA deployments running version 2.3.2 or earlier are affected. Because the vendor has not responded to disclosure, no patched version exists, meaning every production deployment remains vulnerable indefinitely.

Blast Radius: The CVSS 6.3 scoring reflects low-level impact across all three categories (confidentiality, integrity, availability). However, the effective impact in a real-world deployment could be higher if the database account used by the application has elevated privileges, or if the OA platform is federated with identity directories (e.g., LDAP/AD) where credential reuse amplifies the compromise.

Availability Impact (A:L): While the base score rates availability impact as low, an attacker could craft payloads to cause database errors, lock rows, or execute expensive queries leading to denial-of-service conditions on the OA platform — disrupting enterprise operations.

Compliance Considerations: Organizations handling regulated data (PII, financial records) through this platform face regulatory exposure, as unpatched SQL injection vulnerabilities may be viewed as a failure to implement adequate security controls.

Detection Guidance

The detection rules below target exploitation of the /index.php?m=index&a=publicsavevalue&ajaxbool=true endpoint, focusing on SQL metacharacters, suspicious query strings, and anomalous database or web-server behavior.

Sigma Rule

title: Xinhu RockOA publicsavevalue SQL Injection Attempt
id: 5f3c9a2e-8b1d-4c7e-9a2f-6d8e1b3f5a2c
status: experimental
description: Detects SQL injection payloads in the Value parameter of the Xinhu Rainrock RockOA publicsavevalue endpoint.
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'm=index&a=publicsavevalue'
    keywords|contains:
        - "'"
        - " UNION "
        - " OR 1=1"
        - " SLEEP("
        - " BENCHMARK("
        - ";--"
        - "/*"
        - "##"
    condition: selection and keywords
falsepositives:
    - Legitimate form submissions containing apostrophes (e.g., names, comments)
level: high

YARA Rule

rule Xinhu_RockOA_SQLi_Publicsavevalue
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects SQL injection payloads targeting RockOA publicsavevalue endpoint"
        cve = "CVE-2026-84153"
        date = "2026-01-01"
        severity = "high"
    strings:
        $endpoint = "m=index&a=publicsavevalue" ascii nocase
        $sqli1 = " UNION SELECT" ascii nocase
        $sqli2 = " OR 1=1" ascii nocase
        $sqli3 = "SLEEP(" ascii nocase
        $sqli4 = "BENCHMARK(" ascii nocase
        $sqli5 = "'--" ascii
        $sqli6 = "\x27 OR \x27" ascii
    condition:
        $endpoint and 2 of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET WEB_SPECIFIC_APPS Xinhu RockOA publicsavevalue SQL Injection Attempt (CVE-2026-84153)";
    flow:established,to_server;
    http.uri;
    content:"m=index&a=publicsavevalue";
    http.request_body;
    content:"Value=";
    nocase;
    pcre:"/Value=[^&]*(?:['\"]|UNION\s+SELECT|OR\s+1\s*=\s*1|SLEEP\s*\(|BENCHMARK\s*\()/i";
    reference:cve,2026-84153;
    classtype:web-application-attack;
    sid:2026084153;
    rev:1;
)

Elastic Detection

sequence by source.ip, user.name with maxspan=10m
  [network where destination.port == 80 or destination.port == 443] 
  [http where url.path contains "index.php" and 
     url.query contains "m=index" and 
     url.query contains "a=publicsavevalue" and
     (url.query contains "'" or 
      url.query contains "UNION" or 
      url.query contains "SLEEP" or 
      url.query contains "OR 1=1")]
  [process where event.action == "execve"]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/index.php" AND uri_query="*m=index*a=publicsavevalue*"
| rex field=uri_query "Value=(?<value_param>[^&]+)"
| regex value_param="['\"]|UNION\s+SELECT|OR\s+1\s*=\s*1|SLEEP\s*\(|BENCHMARK\s*\("
| stats count by src_ip, uri_query, _time
| where count > 3
| table _time, src_ip, uri_query, count

Wazuh OSSEC Rule

<group name="web_application_attacks,">
  <rule id="841530" level="12">
    <if_sid>315</if_sid>
    <match>index.php?m=index&a=publicsavevalue</match>
    <regex>Value=.*['\x22]</regex>
    <description>Xinhu RockOA publicsavevalue SQL injection attempt (CVE-2026-84153)</description>
    <group>sql_injection,cve-2026-84153</group>
  </rule>
  <rule id="841531" level="14">
    <if_sid>841530</if_sid>
    <regex>UNION\s+SELECT|OR\s+1\s*=\s*1|SLEEP\(|BENCHMARK\(</regex>
    <description>Xinhu RockOA publicsavevalue confirmed SQL injection payload (CVE-2026-84153)</description>
    <group>sql_injection,cve-2026-84153</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch or vendor fix exists. The vendor (Xinhu) was contacted early but did not respond in any way.

Immediate Mitigations:

1. Restrict Endpoint Access: Implement Web Application Firewall (WAF) rules to block or sanitize requests to /index.php?m=index&a=publicsavevalue that contain SQL metacharacters or reserved SQL keywords in the Value parameter.
2. Disable the Endpoint: If the publicsavevalue functionality is not critical to business operations, disable or block the endpoint at the reverse proxy or application level until a patch is available.
3. Enforce Strong Authentication: Require multi-factor authentication (MFA) for all accounts. Since the attack surface is limited to authenticated users, MFA substantially reduces the risk of credential-based exploitation.
4. Least-Privilege Database Accounts: Ensure the application's database credentials have the minimum necessary privileges — no FILE privilege, no DROP on core tables, and no ability to write to the filesystem.

Patch/Upgrade Steps:

1. Monitor Xinhu's official website and GitHub repository for security patches or version 2.3.3+ releases.
2. Subscribe to CVE notification feeds and threat-intel platforms such as valtersit.com for updates on vendor response or community-developed patches.
3. If the vendor remains unresponsive, consider migrating to an actively maintained OA platform or deploying a code-level workaround contributed by the security community.

Long-Term Hardening:

1. Input Validation: Implement parameterized queries or prepared statements for all database operations, particularly in the toaddval function or its replacement.
2. Web Application Firewall: Deploy and continuously tune a WAF to block SQL injection attempts across all endpoints.
3. Security Monitoring: Enable detailed web-server and database logging; correlate logs with the detection rules provided above.
4. Vendor Risk Assessment: For procurement, evaluate the vendor's security-response track record. A vendor that remains unresponsive to a disclosed vulnerability may be unsuitable for environments with high security requirements.

References

1. NVD Entry — CVE-2026-84153: https://nvd.nist.gov/vuln/detail/CVE-2026-84153 — Official CVE record with description, CVSS vector, and CWE classification.

2. CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component: https://cwe.mitre.org/data/definitions/74.html — Reference for the vulnerability class.

3. Xinhu Rainrock RockOA Official Site: https://www.rockoa.com/ — Vendor page to monitor for security patches and version releases.

4. ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ — MITRE ATT&CK framework mapping for this exploit.

5. NVD CVSS Calculator (CVSS:3.1): https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator — Reference for CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Note: No active exploitation in the wild was identified in the provided data. No CISA KEV (Known Exploited Vulnerabilities) entry exists for CVE-2026-84153. The exploit has been publicly disclosed in security circles, which elevates the risk of weaponization in the near term. No specific threat-actor campaigns have been attributed to this vulnerability at the time of writing.