Jinher OA C6 CVE-2026-11412

Low-privilege authentication is required - the CVSS vector PR:L confirms that unauthenticated exploitation is not supported by available data. The attacker must hold a valid low-privilege account within the Jinher OA C6 application and have network access to the web interface. The specific injectable endpoint is /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx via the queryID parameter; exploitation is conditional on this endpoint being reachable and not blocked by intervening controls. Exploitation is limited by: the authentication requirement (ruling out opportunistic internet-scale scanning without credentials), and the low confidentiality/integrity impact scope suggested by CVSS metrics (indicating the injected query may operate within a constrained data context). Organizations that restrict OA access to internal networks significantly reduce exposure.

The CVSS 4.0 base score of 2.1 (Low) is driven by the limited impact metrics: VC:L/VI:L/VA:L reflect only low confidentiality, integrity, and availability impact - likely reflecting constrained query scope rather than full database compromise. The vector AV:N/AC:L/AT:N/UI:N indicates this is network-exploitable with low complexity and no user interaction, but PR:L confirms a low-privilege authenticated session is required, which partially limits automated mass exploitation. The E:P modifier in the CVSS vector acknowledges the publicly available POC, consistent with the GitHub exploit reference. No EPSS score was provided in the input data. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread active exploitation at time of analysis. The combination of a public POC and a non-responsive vendor with no patch is a meaningful risk amplifier despite the low CVSS score - SQL injection severity in practice often exceeds CVSS impact ratings if the database account holds elevated privileges.

An attacker with a low-privilege Jinher OA account crafts an HTTP request to /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx, injecting SQL payloads into the queryID parameter based on the publicly available POC at https://github.com/MichaelZhuang521/cve/issues/3. Depending on the database account's permissions, the attacker can enumerate table structures, extract user credentials or sensitive business data, or manipulate records. Because the POC is public and the attack complexity is low, insider threats or credential-compromised accounts represent the most realistic threat actor profile.