An unauthenticated remote XML External Entity (XXE) vulnerability in Jinher OA 2.0 allows attackers to perform unauthorized file operations, posing a significant risk to system integrity.

This vulnerability is an XML External Entity (XXE) injection flaw located in the /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx endpoint. The flaw allows an unauthenticated remote attacker to influence XML parsing, potentially leading to unauthorized data exposure or system manipulation.

Successful exploitation of this vulnerability could lead to the exposure of sensitive server-side files or unauthorized interaction with internal system resources. Given the CVSS score of 7.3, this is a high-severity risk that could result in significant data compromise or service disruption if the application is exposed to the internet.

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict network access to the affected /c6/Jhsoft.Web.module/ directory and monitor vendor communication channels for an official security update.

Proactive Monitoring: Review web access logs for unusual requests directed at the GetWordFileName.aspx endpoint, particularly those containing XML structures or suspicious parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block or inspect XML input for XXE payloads, specifically targeting the vulnerable endpoint path.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue tracker.

Given the availability of a public proof-of-concept and the remote, unauthenticated nature of this vulnerability, immediate defensive action is required. Organizations using Jinher OA 2.0 should prioritize hardening the web server configuration and applying compensating controls until a vendor-supplied patch is available. Failure to secure this endpoint could allow attackers to bypass security controls and access sensitive system data.