Description

A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx. This manipulation of the argument httpOID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-15T19:16:32.300Z",
  "pubdate": "2026-08-15T19:16:32.300Z",
  "executiveSummary": "A security flaw has been identified in Jinher OA version 1.0, specifically within the attendance management module. The vulnerability involves an SQL injection weakness accessible via an unknown function in the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx.\nAn unauthenticated remote attacker can exploit this vulnerability by manipulating the httpOID parameter, allowing malicious SQL commands to be injected and executed directly against the underlying database management system.\nThe successful exploitation of this vulnerability can lead to unauthorized access, data exfiltration, database manipulation, and potentially complete compromise of the affected system's underlying database infrastructure.\nPublicly available exploit code increases the urgency of remediation. The vendor has been notified of this disclosure but has failed to provide a response or official patch, leaving deployments exposed to active threat actors.",
  "technicalDetails": "The vulnerability resides in Jinher OA 1.0 within the web application component located at /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx. The root cause of the vulnerability is insufficient input validation and improper sanitization of user-supplied data passed through the HTTP parameter httpOID.\nBecause the application fails to properly parameterize queries or enforce strict type checking on the httpOID parameter, string-based SQL injection occurs when malicious payloads are concatenated directly into database query strings executed by the backend database management system.\nThe attack vector is fully remote and network-exploitable, requiring no prior authentication or specific user privileges. An attacker initiates the attack by sending a crafted HTTP request containing malicious SQL syntax injected into the vulnerable httpOID parameter of the attendance_out_approve.aspx endpoint.\nUpon receiving the malicious request, the vulnerable script processes the input and forwards the unvalidated payload to the database engine. The database executes the injected SQL commands within the context of the application's database user account.\nDepending on the permissions associated with the database connection, post-exploitation impact includes the extraction of sensitive data such as user credentials and internal records, unauthorized modification or deletion of database contents, and potentially execution of administrative commands on the underlying database server."
}