Executive brief
Jinher OA, an office automation platform used for business management and workflow coordination, contains a critical security flaw. An unauthenticated attacker can remotely access or manipulate the underlying database by sending a specially crafted web request. This could lead to the theft of sensitive business data, unauthorized changes to records, or a complete compromise of the system.
Technical details
A SQL injection vulnerability exists in Jinher OA 1.0 within the /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx component. The root cause is the improper neutralization of the 'httpOID' parameter, which is directly concatenated into SQL queries without validation or parameterization. An unauthenticated remote attacker can exploit this via a crafted HTTP GET request to the PlanSelect function. Successful exploitation allows for arbitrary SQL command execution against the backend Microsoft SQL Server database, potentially leading to data exfiltration, privilege escalation, or remote code execution on the database server. A public exploit (PoC) has been released, and the vendor has reportedly not responded to disclosure attempts.
Affected products
- Jinher OA (Jhsoft OA) 1.0
Timeline
- 2026-06-05: disclosed: Initial vulnerability report published on GitHub
- 2026-07-13: advisory: CVE published in NVD dataset