A critical XML External Entity injection vulnerability in Jinher OA allows unauthenticated remote attackers to potentially access unauthorized system information.

This vulnerability is an XML External Entity (XXE) injection flaw located in the /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx file. The flaw allows an unauthenticated, remote attacker to manipulate XML inputs to trigger unauthorized references.

The exploitation of this vulnerability could lead to the exposure of sensitive internal system data or server-side files, potentially facilitating further attacks against the infrastructure. With a CVSS score of 7.3, this issue represents a significant risk to the confidentiality and integrity of the application environment. Successful exploitation could lead to unauthorized information disclosure, impacting business operations and data privacy.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected WebDesign.aspx endpoint and disable the vulnerable module if it is not required for business operations.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing XML payloads or unexpected parameters directed at the WebDesign.aspx file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block XXE-related injection patterns and malicious XML entity declarations.

Public Exploit Available: Yes, a published proof-of-concept exists, as attributed to the technical write-up provided in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability poses an elevated risk of exploitation. Organizations using Jinher OA 2.0 should implement strict access controls and WAF filtering immediately to prevent unauthorized access until a security update is released by the vendor.