Oa
Monthly
SQL injection in Jinher OA C6 lets remote, unauthenticated attackers manipulate the ProjID argument submitted to /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx so that attacker-controlled input reaches a backend database query, with a limited confidentiality, integrity and availability impact (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Any organization exposing this endpoint of the Jinher OA C6 collaboration platform to a network is in scope; exploitation requires only that the page be reachable, since no credentials or user interaction are needed per the assessed vector. No vendor-released patch has been identified - the vendor was contacted ahead of disclosure and did not respond - and a public PoC reference exists, though it is not verified as working exploit code, so real-world reliability remains unproven.
SQL injection in Jinher OA 1.0 exposes the PlanGiveOut.aspx endpoint to remote unauthenticated exploitation via the unsanitized `httpOID` parameter, enabling database enumeration, data exfiltration, and record manipulation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no prerequisites beyond network access. A public proof-of-concept exploit has been published on GitHub (CVE-2026-15517 issue tracker), the vendor did not respond to coordinated disclosure, and no patch exists at time of analysis.
SQL injection in Jinher OA 1.0 allows remote unauthenticated attackers to manipulate the httpOID parameter of nextselectplan.aspx to inject arbitrary SQL statements. Publicly available exploit code exists per VulDB disclosure, and the vendor did not respond to coordinated disclosure attempts, increasing the window of exposure. CVSS 7.3 reflects network-reachable, low-complexity exploitation with limited confidentiality, integrity, and availability impact on the database backend.
SQL injection in Jinher OA C6's GetFormSn.aspx endpoint allows remote low-privilege authenticated attackers to manipulate the queryID parameter, potentially reading, modifying, or deleting backend database records. A public proof-of-concept exploit is available on GitHub, lowering the barrier to exploitation. No patch exists - the vendor was notified early but did not respond, leaving no official remediation path.
SQL injection in Jinher OA 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the DeptIDList parameter in UserSel.aspx. The vulnerability permits unauthorized database access with potential for data exfiltration, modification, and limited system compromise. Public exploit code exists on GitHub (zzlln/cvecve), significantly lowering the barrier to exploitation. Vendor did not respond to disclosure, leaving patch status unknown.
SQL injection in Jinher OA C6 lets remote, unauthenticated attackers manipulate the ProjID argument submitted to /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx so that attacker-controlled input reaches a backend database query, with a limited confidentiality, integrity and availability impact (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Any organization exposing this endpoint of the Jinher OA C6 collaboration platform to a network is in scope; exploitation requires only that the page be reachable, since no credentials or user interaction are needed per the assessed vector. No vendor-released patch has been identified - the vendor was contacted ahead of disclosure and did not respond - and a public PoC reference exists, though it is not verified as working exploit code, so real-world reliability remains unproven.
SQL injection in Jinher OA 1.0 exposes the PlanGiveOut.aspx endpoint to remote unauthenticated exploitation via the unsanitized `httpOID` parameter, enabling database enumeration, data exfiltration, and record manipulation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no prerequisites beyond network access. A public proof-of-concept exploit has been published on GitHub (CVE-2026-15517 issue tracker), the vendor did not respond to coordinated disclosure, and no patch exists at time of analysis.
SQL injection in Jinher OA 1.0 allows remote unauthenticated attackers to manipulate the httpOID parameter of nextselectplan.aspx to inject arbitrary SQL statements. Publicly available exploit code exists per VulDB disclosure, and the vendor did not respond to coordinated disclosure attempts, increasing the window of exposure. CVSS 7.3 reflects network-reachable, low-complexity exploitation with limited confidentiality, integrity, and availability impact on the database backend.
SQL injection in Jinher OA C6's GetFormSn.aspx endpoint allows remote low-privilege authenticated attackers to manipulate the queryID parameter, potentially reading, modifying, or deleting backend database records. A public proof-of-concept exploit is available on GitHub, lowering the barrier to exploitation. No patch exists - the vendor was notified early but did not respond, leaving no official remediation path.
SQL injection in Jinher OA 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the DeptIDList parameter in UserSel.aspx. The vulnerability permits unauthorized database access with potential for data exfiltration, modification, and limited system compromise. Public exploit code exists on GitHub (zzlln/cvecve), significantly lowering the barrier to exploitation. Vendor did not respond to disclosure, leaving patch status unknown.