Xinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scripting

The primary impact of CVE-2026-0587 is the potential for cross-site scripting (XSS) attacks. An attacker could craft a malicious URL or inject script tags through the 'fengmian' parameter, which, when accessed by a user, would execute the attacker's script within the user's browser context. This could lead to session hijacking, where the attacker steals the user's session cookie and gains unauthorized access to their account. Furthermore, the attacker could deface the website, redirect users to malicious sites, or steal sensitive information entered into web forms. The availability of a public exploit significantly increases the likelihood of exploitation, particularly against unpatched installations.

Organizations using Rainrock RockOA versions 2.7.0 through 2.7.1, particularly those with publicly accessible instances, are at risk. Shared hosting environments where RockOA is installed are especially vulnerable due to the potential for cross-tenant exploitation.

• php / web:

grep -r 'fengmian' /var/www/rockoa/ -l

• php / web:

find /var/www/rockoa/ -name 'rock_page_gong.php' -print

• generic web:

curl -I http://your-rockoa-site.com/rock_page_gong.php?fengmian=<script>alert(1)</script>

1. 2026-01-05Disclosure

   disclosure

1. 已保留2026-01-04
2. 发布日期2026-01-05
3. 修改日期2026-02-23
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-0587 is to upgrade Rainrock RockOA to a patched version. As of this writing, a specific patched version is not provided. Until a patch is available, consider implementing input validation and sanitization on the 'fengmian' parameter within the rockpagegong.php file. Web application firewalls (WAFs) configured to detect and block XSS payloads targeting this specific file and parameter can provide an additional layer of defense. Regularly monitor web server access logs for suspicious requests containing unusual characters or patterns in the 'fengmian' parameter.