Jinher OA versions 1.0 through 1.2 are vulnerable to a remote SQL injection flaw that could allow unauthorized database interaction.

This is a SQL injection vulnerability (CWE-89) triggered by improper sanitization of the ID argument within the /C6/Jhsoft.Web.departments/GetTreeDate.aspx file. The vulnerability is exploitable by unauthenticated remote attackers.

The presence of this vulnerability poses a significant risk to data confidentiality and integrity. Successful exploitation allows an attacker to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data exfiltration or modification. Given the CVSS score of 7.3, this is classified as a high severity issue that requires immediate attention to prevent compromise of business-critical information.

Immediate Action: Contact the vendor for the latest security patches or updates for Jinher OA. If a patch is not yet available, restrict network access to the /C6/Jhsoft.Web.departments/GetTreeDate.aspx endpoint.

Proactive Monitoring: Monitor web server logs for suspicious requests containing SQL syntax or unusual parameters directed at the GetTreeDate.aspx file.

Compensating Controls: Implement Web Application Firewall (WAF) rules designed to detect and block SQL injection patterns targeting the identified vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub issue.

This vulnerability represents a high risk to the organization due to the availability of proof-of-concept code and the lack of required authentication for exploitation. Security teams should prioritize identifying all instances of Jinher OA in their environment and apply vendor-supplied updates as soon as they are released. Until updates are applied, network-level restrictions or WAF filtering should be employed to mitigate the risk of remote SQL injection attempts.