EUVD-2026-34970
GHSA-xhq4-92wj-h688
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in Jinher OA 1.0. This affects an unknown function of the file nextselectplan.aspx. Such manipulation of the argument httpOID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Jinher OA 1.0 allows remote unauthenticated attackers to manipulate the httpOID parameter of nextselectplan.aspx to inject arbitrary SQL statements. Publicly available exploit code exists per VulDB disclosure, and the vendor did not respond to coordinated disclosure attempts, increasing the window of exposure. CVSS 7.3 reflects network-reachable, low-complexity exploitation with limited confidentiality, integrity, and availability impact on the database backend.
Technical ContextAI
Jinher OA is an ASP.NET-based office automation suite developed by Jinher Software (commonly deployed in Chinese enterprise environments). The vulnerable component is nextselectplan.aspx, a server-side .aspx handler that incorporates the httpOID HTTP parameter into a SQL statement without proper parameterization or input validation. This matches CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the canonical SQL injection class, where attacker-controlled input alters the structure of a query executed against the backing database (typically Microsoft SQL Server in OA stacks of this era).
RemediationAI
No vendor-released patch identified at time of analysis, as VulDB reports the vendor did not respond to disclosure. Operators of Jinher OA 1.0 should immediately restrict network reachability to nextselectplan.aspx - for example, by placing the application behind an authenticated VPN or IP allowlist (trade-off: breaks remote employee access), and by deploying a WAF rule that blocks or sanitizes SQL metacharacters and typical injection payloads in the httpOID parameter (trade-off: WAF bypasses for SQLi are well documented, so treat this as defense-in-depth, not a fix). Apply least-privilege to the database account used by the application so a successful injection cannot read system tables or execute xp_cmdshell. Monitor for anomalous queries originating from the OA service account and review IIS logs for suspicious httpOID values. Track the VulDB entry at https://vuldb.com/vuln/369015 and the upstream vendor channels for any future patched build before reopening external access.
SQL injection in Jinher OA 1.0 exposes the PlanGiveOut.aspx endpoint to remote unauthenticated exploitation via the unsa
SQL injection in Jinher OA 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the DeptIDL
SQL injection in Jinher OA C6's GetFormSn.aspx endpoint allows remote low-privilege authenticated attackers to manipulat
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today