An unauthenticated remote XML External Entity (XXE) vulnerability in Jinher OA versions 1.0 through 1.2 poses a significant risk of unauthorized data disclosure.

This vulnerability is an XML External Entity (XXE) reference flaw (CWE-611) located in the /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx endpoint. The issue allows an unauthenticated remote attacker to manipulate XML inputs, potentially resulting in the disclosure of sensitive server-side data.

The exploitation of this XXE vulnerability can lead to unauthorized access to sensitive files stored on the server, potentially exposing configuration files, credentials, or internal system data. With a CVSS score of 7.3, this flaw represents a high-severity risk that could be leveraged by attackers to facilitate further lateral movement within the network.

Immediate Action: Contact the vendor immediately to obtain a security patch, as no official fixed version is currently documented. If a patch is unavailable, restrict access to the affected TaskManage directory at the network or application firewall level.

Proactive Monitoring: Review web access logs for unusual requests directed at the TaskManage/AddTask.aspx file, specifically looking for XML-formatted payloads containing entity declarations.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing XML entity references or suspicious XML structures targeting the vulnerable endpoint.

Public Exploit Available: Yes — a public proof-of-concept exists via the referenced GitHub issue (https://github.com/Cstarplus/CVE/issues/3).

Given the availability of a public proof-of-concept and the high-severity potential of XXE attacks, organizations using Jinher OA must treat this vulnerability with high priority. We recommend immediate implementation of WAF-based filtering to mitigate the risk while awaiting a formal vendor patch.