A critical XML External Entity vulnerability in Jinher OA 1.1 permits unauthenticated remote attackers to perform unauthorized data processing.

The application improperly handles XML input within the XmlHttp.aspx file, which leads to an XML External Entity (XXE) reference vulnerability. This flaw is exploitable by an unauthenticated attacker sending crafted requests to the target system.

The exploitation of this XXE vulnerability poses a significant risk to organizational data integrity and confidentiality. An attacker can leverage this flaw to disclose sensitive local files, perform server side request forgery, or cause denial of service conditions, justifying the CVSS score of 7.3.

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict access to XmlHttp.aspx at the network level and contact the vendor for emergency hotfixes.

Proactive Monitoring: Security teams should monitor web server logs for suspicious requests containing XML payloads or references to external DTDs or system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block XML-based attacks and specifically filter requests targeting the XmlHttp.aspx endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability represents a credible threat to Jinher OA deployments. Organizations must prioritize hardening the affected endpoint and maintain vigilance for vendor-provided updates to mitigate the risk of unauthorized data access.