EUVD-2026-119604
GHSA-xh95-44r3-wvvp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ProjectAfficheManage.aspx remotely
-
DeliverySupply malicious ProjID parameter
-
ExploitInject SQL into backend query
-
ExecutionDatabase executes attacker SQL
-
ImpactRead or alter OA project data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The specific prerequisite is reaching the ProjectAfficheManage.aspx endpoint at /C6/JHSoft.Web.Project/OfficeReadOnly/ on a deployed Jinher OA C6 instance and supplying a manipulated ProjID argument; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special configuration beyond the product being network-reachable is required. Limiting factors: exploitation is bounded to organizations actually running Jinher OA C6 (a niche, largely China-focused product) with this endpoint exposed to the attacker; no vendor patch exists (vendor unresponsive), and the available PoC is an unverified reference rather than confirmed working exploit code, so real-world reliability is uncertain. |
| Impact | This is a SQL injection (CWE-89) in Jinher OA C6 via the ProjID parameter of /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx, reachable remotely. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation, which is the main driver of concern; however, the impact metrics are only Low across confidentiality, integrity and availability (VC:L/VI:L/VA:L), yielding a modest base score of 5.5. The vuln.today Decision label is 'this_month' - a scheduled-remediation priority rather than act_now or emergency. KEV status is NOT present (not confirmed actively exploited), and no EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. A public PoC reference exists (GitHub issue) but it is not verified as working exploit code, so exploit maturity is Proof-of-Concept (E:P), not weaponized. Net: a genuinely remote, pre-auth SQLi is operationally meaningful, but the Low-rated impacts, absence of KEV, missing EPSS, and unverified PoC place this as a real-but-non-emergency issue for environments actually running Jinher OA C6. The vendor was contacted and did not respond, so no official patch or advisory is available - a factor that raises exposure duration. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to ProjectAfficheManage.aspx with a malicious ProjID value, injecting SQL that the backend executes against the OA database. Depending on the database and query context, this could permit reading or manipulating stored project/announcement data consistent with the Low confidentiality/integrity/availability impacts rated in the CVSS vector. A public PoC reference exists (GitHub issue), but it is not verified as working exploit code, and the trigger specifics beyond the ProjID parameter are not detailed in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 08, 2026
SQL injection in Jinher OA C6 lets remote, unauthenticated attackers manipulate the ProjID argument submitted to /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx so that attacker-controlled input reaches a backend database query, with a limited confidentiality, integrity and availability impact (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Any organization exposing this endpoint of the Jinher OA C6 collaboration platform to a network is in scope; exploitation requires only that the page be reachable, since no credentials or user interaction are needed per the assessed vector. No vendor-released patch has been identified - the vendor was contacted ahead of disclosure and did not respond - and a public PoC reference exists, though it is not verified as working exploit code, so real-world reliability remains unproven.
RemediationAI
No vendor-released patch has been identified at time of analysis - Jinher was contacted before disclosure and did not respond, so there is no fixed version to cite and no advisory URL to point to beyond the VulDB entries (https://vuldb.com/vuln/432651). Until the vendor ships a fix, the practical control is to remove the attack surface: block or take offline the path /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx at the reverse proxy or WAF, accepting that project-announcement read access through that page will stop working for legitimate users. Where the page must stay available, restrict it to trusted internal ranges or VPN-only access and add request-inspection rules that reject SQL metacharacters or unexpected syntax in the ProjID parameter, with the trade-off that legitimate ProjID values carrying unusual characters may be rejected and that WAF signatures are bypassable if the backend query remains unparameterised. Because authentication is not required per the assessed vector, credential-based gating alone should not be relied upon; network-level restriction of the endpoint is the more dependable interim measure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection in the ASP.NET-based Jinher OA C6 collaboration/office suite, specifically inside the OfficeReadOnly module handler ProjectAfficheManage.aspx. The ProjID parameter, which normally identifies a project announcement record, is passed into a database query without adequate neutralisation of SQL syntax, so a crafted value can alter query logic rather than simply select a record. Because the vulnerable code lives behind a web-accessible .aspx page, the attack surface is the HTTP request itself: the CVSS 4.0 vector defined by the reporter and the independent CVSS 3.1 assessment both assign AV:N/AC:L/PR:N/UI:N, meaning the endpoint is reachable over the network and no privileges or interaction are required in the assessed deployment. CPE coverage is a wildcard (cpe:2.3:a:jinher:oa:*:*:*:*:*:*:*:*), so no specific fixed or vulnerable version boundary is documented in the available sources, and the vendor has not published an advisory; the trigger is otherwise not described in the available sources. Impact is bounded to reading and modifying data reachable by the application's database account - the assessed vector rates confidentiality, integrity and availability impacts as Low rather than a full database takeover.
Know when Oa gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote, low-complexity, unauthenticated injection on a reachable endpoint gives AV:N/AC:L/PR:N/UI:N; impacts kept Low to match the input's VC/VI/VA:L rating for this SQLi.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
SQL injection in Jinher OA 1.0 exposes the PlanGiveOut.aspx endpoint to remote unauthenticated exploitation via the unsa
SQL injection in Jinher OA 1.0 allows remote unauthenticated attackers to manipulate the httpOID parameter of nextselect
SQL injection in Jinher OA 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the DeptIDL
SQL injection in Jinher OA C6's GetFormSn.aspx endpoint allows remote low-privilege authenticated attackers to manipulat
Exploit-DB