A critical XML External Entity vulnerability in Jinher OA versions 1.0 through 1.2 allows unauthenticated remote attackers to perform unauthorized data access.

This vulnerability occurs in the XML Handler component within the XmlHttp.aspx file. An unauthenticated attacker can exploit this flaw to perform XML External Entity (XXE) injection, which allows the processing of malicious XML input.

The exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive internal files or server-side data, posing a significant risk to organizational confidentiality. Given the CVSS score of 7.3, this flaw is categorized as High severity, indicating a substantial risk to systems that are reachable by unauthorized remote actors.

Immediate Action: Since no official patch is currently identified, administrators should restrict network access to the vulnerable XmlHttp.aspx endpoint or disable the affected component if it is not business-critical.

Proactive Monitoring: Review web access logs for suspicious requests targeting the /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx path, specifically looking for XML-formatted payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block or sanitize incoming XML requests containing external entity definitions.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up provided by the researcher on GitHub.

Due to the availability of proof-of-concept code and the ease of remote exploitation, organizations using Jinher OA must treat this vulnerability with high priority. Organizations should immediately implement the recommended network-level restrictions or WAF rules while awaiting a vendor-supplied security update to address the underlying XML parsing flaw.