Executive brief
Jinher OA C6, an office automation system used for corporate workflow and document management, contains a security flaw in its form serial number generation component. An attacker can exploit this to interfere with the underlying database, potentially leading to the unauthorized viewing or modification of sensitive business data. This vulnerability is particularly concerning as technical details and exploit methods have been released publicly.
Technical details
A SQL injection vulnerability exists in Jinher OA C6 within the /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx file. The root cause is the improper neutralization of special elements in the 'queryID' GET parameter, which is concatenated directly into SQL queries without sufficient validation or parameterization. An attacker with network access and low-level authentication can provide a crafted payload (e.g., using WAITFOR DELAY) to perform blind SQL injection. This can lead to unauthorized data extraction or database manipulation. Public exploit code has been released, and the vendor has reportedly not responded to disclosure attempts.
Affected products
- Jinher OA C6
Timeline
- 2026-05-06: disclosed: Initial disclosure on GitHub by researcher MichaelZhuang521
- 2026-06-06: advisory: NVD and VulDB published the vulnerability details