EUVD-2026-34970
GHSA-xhq4-92wj-h688
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Jinher OA instance
-
DeliverySend crafted HTTP request to nextselectplan.aspx
-
ExploitInject SQL payload via httpOID parameter
-
ExecutionDatabase executes attacker-controlled query
-
ImpactExfiltrate or modify database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Jinher OA 1.0, provided the nextselectplan.aspx endpoint is network-reachable to the attacker. Limiting factors are minimal: no user interaction is required (UI:N), no credentials are needed (PR:N), and complexity is low (AC:L); the only meaningful constraints are that the target must be running Jinher OA 1.0 with the vulnerable nextselectplan.aspx handler deployed and that network reachability to the HTTP(S) listener exists. Scope is unchanged (S:U), so impact is bounded to the database and application's own security authority rather than the underlying OS. |
| Impact | Multiple signals point to a moderate but credible risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, low-complexity, unauthenticated exploitation, and the 'E:P' temporal metric corroborates that proof-of-concept code is public - consistent with the GitHub exploit reference. However, impacts are scored Low across CIA (C:L/I:L/A:L), suggesting partial data exposure rather than full database takeover from a single injection point; chained SQLi techniques (UNION, stacked queries) could still escalate to full disclosure depending on DB permissions. The CVE is NOT listed in CISA KEV, and no EPSS score was provided in the input - so widespread, automated exploitation cannot be asserted. The vendor's non-response (per VulDB) means no coordinated patch is known, which materially raises practical risk for exposed instances. Net: prioritize for any internet-facing Jinher OA 1.0 deployment, but treat as a targeted-exploitation candidate rather than a confirmed mass-exploited bug absent KEV/EPSS data. |
| Exploit ScenarioDerived | A remote attacker scans for internet-exposed Jinher OA instances and issues an HTTP request to /nextselectplan.aspx with a crafted httpOID parameter (for example, a UNION-based payload) to extract usernames, password hashes, or business records from the backing database. Because the publicly available exploit referenced on GitHub provides a working payload template, weaponization effort is minimal and the attacker can iterate quickly toward full database enumeration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 06, 2026
SQL injection in Jinher OA 1.0 allows remote unauthenticated attackers to manipulate the httpOID parameter of nextselectplan.aspx to inject arbitrary SQL statements. Publicly available exploit code exists per VulDB disclosure, and the vendor did not respond to coordinated disclosure attempts, increasing the window of exposure. CVSS 7.3 reflects network-reachable, low-complexity exploitation with limited confidentiality, integrity, and availability impact on the database backend.
RemediationAI
No vendor-released patch identified at time of analysis, as VulDB reports the vendor did not respond to disclosure. Operators of Jinher OA 1.0 should immediately restrict network reachability to nextselectplan.aspx - for example, by placing the application behind an authenticated VPN or IP allowlist (trade-off: breaks remote employee access), and by deploying a WAF rule that blocks or sanitizes SQL metacharacters and typical injection payloads in the httpOID parameter (trade-off: WAF bypasses for SQLi are well documented, so treat this as defense-in-depth, not a fix). Apply least-privilege to the database account used by the application so a successful injection cannot read system tables or execute xp_cmdshell. Monitor for anomalous queries originating from the OA service account and review IIS logs for suspicious httpOID values. Track the VulDB entry at https://vuldb.com/vuln/369015 and the upstream vendor channels for any future patched build before reopening external access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Jinher OA is an ASP.NET-based office automation suite developed by Jinher Software (commonly deployed in Chinese enterprise environments). The vulnerable component is nextselectplan.aspx, a server-side .aspx handler that incorporates the httpOID HTTP parameter into a SQL statement without proper parameterization or input validation. This matches CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the canonical SQL injection class, where attacker-controlled input alters the structure of a query executed against the backing database (typically Microsoft SQL Server in OA stacks of this era).
Know when Oa gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Jinher OA 1.0. This affects an unknown function of the file nextselectplan.aspx. Such manipulation of the argument httpOID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Jinher OA 1.0 contains an unauthenticated SQL injection vulnerability in the nextselectplan.aspx endpoint that allows remote attackers to directly execute arbitrary SQL statements against the database backend. With publicly available exploit code in circulation and the vendor unresponsive to coordinated disclosure, organizations face immediate risk of data breach, unauthorized modification of records, and potential system compromise affecting all personnel reliant on Jinher OA functionality.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deploy WAF-based input validation to block SQL injection payloads targeting the httpOID parameter; (2) Restrict network access to Jinher OA 1.0 to authenticated internal users only, blocking all remote/untrusted access; (3) Enable database activity monitoring (DAM) and configure alerts for unusual SQL execution, schema access attempts, or privilege escalation; (4) Implement query logging at the database layer to support post-incident forensics; (5) Establish escalation protocol with Jinher for security advisories, or accelerate product replacement given vendor non-responsiveness to disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
SQL injection in Jinher OA 1.0 exposes the PlanGiveOut.aspx endpoint to remote unauthenticated exploitation via the unsa
SQL injection in Jinher OA 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the DeptIDL
SQL injection in Jinher OA C6's GetFormSn.aspx endpoint allows remote low-privilege authenticated attackers to manipulat
Exploit-DB