An unauthenticated XML External Entity vulnerability in Jinher OA 1.2 poses a significant security risk by allowing unauthorized remote access to system resources.

This vulnerability is an XML External Entity (XXE) injection flaw located in the ProjectScheduleDelete.aspx file. It allows an unauthenticated remote attacker to manipulate XML input to potentially disclose sensitive internal data or cause system disruption.

The vulnerability carries a CVSS score of 7.3, indicating a High severity risk. Successful exploitation could lead to the unauthorized disclosure of sensitive configuration files or internal server data, potentially resulting in a breach of confidentiality and loss of proprietary information.

Immediate Action: Since no specific patch is currently available, administrators should restrict network access to the ProjectScheduleDelete.aspx endpoint and monitor for suspicious XML-related payloads.

Proactive Monitoring: Review web server access logs for anomalous requests containing external entity declarations or unexpected file access attempts within the OA directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests that contain XML entity references or suspicious XML structures targeting the affected endpoint.

Public Exploit Available: Yes, a public proof of concept has been published via the GitHub issue referenced in the vulnerability report.

Given the availability of a public proof-of-concept and the nature of XXE vulnerabilities, this issue presents a clear risk of exploitation. Organizations using Jinher OA 1.2 must prioritize the implementation of compensating controls, such as WAF rules, and maintain heightened vigilance until an official vendor patch is released.