Jinher OA CVE-2026-15517

No authentication is required - the CVSS 4.0 vector PR:N and UI:N confirm unauthenticated, no-interaction exploitation. The sole prerequisite is network reachability to the Jinher OA web application on its HTTP/HTTPS port, specifically the /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx endpoint. Exploitation is limited to deployments where this ASP.NET page is accessible; organizations that have not deployed the Plan Summarize module or have restricted access to internal networks only face reduced risk. The wildcard CPE version suggests all Jinher OA deployments are potentially in scope, not only version 1.0. Attack complexity is low (AC:L) with no specific timing or race condition required.

The CVSS 4.0 score of 6.9 (Medium) with VC:L/VI:L/VA:L reflects a conservative partial-impact rating, but this likely understates realistic risk: SQL injection in an OA backend typically permits full database table read and write, not merely limited access, unless row-level security or stored procedure isolation is in place - neither of which is indicated by available data. The AV:N/AC:L/AT:N/PR:N/UI:N metrics confirm this is a trivial, unauthenticated, network-reachable attack requiring no user interaction, making it highly automatable. The presence of a public POC (E:P in the CVSS 4.0 supplemental vector) materially increases practical exploitability. No CISA KEV listing was identified, suggesting exploitation has not yet been confirmed at scale, but the low barrier to exploit and absent vendor patch create conditions for opportunistic scanning campaigns. The CVSS impact metrics may conflict with the actual blast radius of a SQL injection against an OA database - defenders should treat confidentiality and integrity risk as higher than the Medium score implies.

An attacker with network access to a Jinher OA 1.0 instance sends a crafted HTTP GET or POST request to /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx with a SQL payload injected into the httpOID parameter (e.g., httpOID=1' UNION SELECT table_name,NULL FROM information_schema.tables--). Using the publicly available POC on GitHub as a reference, the attacker enumerates database tables and extracts employee records, credentials, or plan data stored in the OA backend. No authentication or prior access is required, making this suitable for automated scanning.