CVE-2019-9846

RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2019-06-28

Last modified

2024-08-04

Weaknesses

CWE-89

Affected products

• Rockoa (Rockoa)

References

• https://www.seebug.org/vuldb/ssvid-97861