EUVD-2026-43259
GHSA-g9x4-g2rg-r435
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated SQL injection with no user interaction; C:H and I:H reflect typical full database read/write capability of unmitigated SQLi; A:L as application disruption is secondary.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx. This manipulation of the argument httpOID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Jinher OA 1.0 exposes the PlanGiveOut.aspx endpoint to remote unauthenticated exploitation via the unsanitized httpOID parameter, enabling database enumeration, data exfiltration, and record manipulation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no prerequisites beyond network access. A public proof-of-concept exploit has been published on GitHub (CVE-2026-15517 issue tracker), the vendor did not respond to coordinated disclosure, and no patch exists at time of analysis.
Technical ContextAI
CWE-89 (Improper Neutralization of Special Elements in SQL Commands) is the root cause: the httpOID query parameter in the ASP.NET WebForms page PlanGiveOut.aspx, located under the JHSoft.Web.PlanSummarize module path /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx, is passed unsanitized into a backend SQL query. Jinher OA is a Chinese-developed enterprise Office Automation platform built on the Microsoft ASP.NET/IIS stack. The CPE string cpe:2.3:a:jinher:oa:*:*:*:*:*:*:*:* uses a wildcard for the version field, suggesting NVD has not bounded the affected version set beyond the 1.0 explicitly cited in the description. Classic SQL injection of this type can yield UNION-based or error-based database extraction, and potentially stacked queries enabling DDL/DML operations depending on database user privileges.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure. As a primary compensating control, restrict or block access to /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx at the web server (IIS URL Authorization or web.config deny rules) or perimeter firewall, accepting the trade-off that Plan Summarize distribution functionality will be unavailable to users. Deploy a Web Application Firewall with SQL injection detection rules (OWASP Core Rule Set or equivalent) in blocking mode for the Jinher OA application, noting this introduces latency and may produce false positives requiring tuning. Restrict the OA application's database service account to the minimum necessary privileges (SELECT only on required tables, no DDL rights), reducing the blast radius if injection succeeds. Monitor database query logs for anomalous UNION, SLEEP, or WAITFOR patterns originating from the OA application. Reference the VulDB advisory at https://vuldb.com/vuln/377846 and the POC at https://github.com/weini587/CVE/issues/1 for payload patterns to inform WAF rules.
SQL injection in Jinher OA 1.0 allows remote unauthenticated attackers to manipulate the httpOID parameter of nextselect
SQL injection in Jinher OA 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the DeptIDL
SQL injection in Jinher OA C6's GetFormSn.aspx endpoint allows remote low-privilege authenticated attackers to manipulat
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today