CVE-2025-9602
BaseFortify
Publication date: 2025-08-29
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rockoa | rockoa | to 2.6.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9602 is an improper authorization vulnerability in Xinhu RockOA versions up to 2.6.9, specifically in the publicsaveAjax function of /index.php. This function does not properly verify user permissions, allowing logged-in users with low privileges to perform unauthorized actions such as creating or modifying database records arbitrarily. This leads to both vertical and horizontal privilege escalation, meaning users can perform actions reserved for higher-privileged users or affect other users' data without permission. [1, 3]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized data manipulation, including creating or modifying records in the database without proper authorization. Attackers can escalate their privileges vertically (performing admin-level actions) or horizontally (modifying other users' data). This compromises the confidentiality, integrity, and availability of the affected system, potentially allowing attackers to bypass administrator-only functions and disrupt normal operations. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by identifying if your Xinhu RockOA installation is version 2.6.9 or earlier and if the /index.php publicsaveAjax endpoint is accessible. Attackers may use Google dorking with queries like "inurl:index.php" to find vulnerable targets. Detection on your system could involve monitoring for unusual POST requests to /index.php targeting the publicsaveAjax function, especially those attempting to manipulate database records without proper authorization. Specific commands are not provided, but monitoring web server logs for suspicious POST requests to /index.php with parameters related to publicsaveAjax could help detect exploitation attempts. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable publicsaveAjax endpoint, implementing strict authorization checks to verify user permissions before allowing database modifications, and ensuring that only authorized users can perform sensitive operations. Since no official mitigations or patches are published, it is recommended to replace or upgrade the affected Xinhu RockOA version to a non-vulnerable version if available. Additionally, monitoring and blocking suspicious requests targeting this endpoint can reduce risk. [2, 3]