Jinher OA CVE-2026-7670

Remote exploitation against the /C6/JHSoft.Web.PlanSummarize/UserSel.aspx endpoint when network-accessible. CVSS vector PR:N confirms no authentication required - any remote attacker can reach the vulnerable parameter. The specific condition is that UserSel.aspx must be deployed and accessible (appears to be default in Jinher OA 1.0 plan summarization module based on file path). No special product features, non-default configurations, or user interaction required. Attack success depends on backend database query structure accepting the DeptIDList parameter in a vulnerable SQL statement, which the CVE description and exploit availability confirm. Limiting factors: exploitation impact is constrained by database user privileges assigned to the OA application's connection string - if the database account has restricted permissions (no INSERT/UPDATE/DELETE or limited table access), attacker capabilities are reduced from the theoretical maximum. Network exposure is the primary variable - internet-facing deployments face higher risk than internal-only installations behind corporate firewalls.

CVSS 7.3 (High) reflects network-accessible unauthenticated exploitation with low complexity (AV:N/AC:L/PR:N/UI:N), though impact is rated Low across confidentiality, integrity, and availability (C:L/I:L/A:L). The Exploit maturity metric shows E:P (Proof-of-concept exploit exists), confirmed by the public GitHub repository containing exploit code. However, EPSS and CISA KEV data are not provided in the intelligence, preventing assessment of real-world exploitation prevalence. The combination of unauthenticated network access, public exploit availability, and SQL injection's well-understood attack patterns suggests this is readily exploitable by moderately skilled attackers. The primary risk limiter is the Low impact ratings - suggesting the vulnerable query may have restricted database privileges or limited accessible data. Real-world priority depends heavily on: (1) whether the OA system is internet-exposed versus internal-only, (2) database user permissions on the backend, and (3) sensitivity of accessible department/user data. Vendor non-responsiveness (per description) is a significant red flag, indicating no official patch may be forthcoming. Organizations running Jinher OA 1.0 should treat this as actionable risk requiring immediate attention, particularly if the application handles sensitive HR or organizational data.

An external attacker identifies a Jinher OA 1.0 installation exposed to the internet via reconnaissance scanning. Using the publicly available exploit code from GitHub (zzlln/cvecve), they craft a malicious HTTP request to /C6/JHSoft.Web.PlanSummarize/UserSel.aspx with a SQL injection payload in the DeptIDList parameter, such as DeptIDList=1' UNION SELECT username,password,email FROM users--. The unvalidated input executes against the backend database, returning user credentials or organizational structure data. Depending on database permissions, the attacker escalates to extract sensitive employee information, modify department assignments, or potentially achieve operating system command execution if advanced database features are enabled.