An unauthenticated SQL injection vulnerability in Jinhe OA version 1.0 allows remote attackers to execute arbitrary database queries and potentially compromise the underlying system.

This flaw is a SQL injection (CWE-89) located in the UserSel.aspx component of Jinhe OA, specifically within the DeptIDList parameter, and can be successfully triggered by an unauthenticated remote attacker.

A successful exploit allows attackers to read, modify, or delete sensitive backend database contents, potentially leading to unauthorized data access and total system compromise. With a CVSS score of 7.3, this high severity vulnerability reflects significant risk to confidentiality and integrity, particularly since the flaw requires zero privileges or user interaction to exploit.

Immediate Action: Implement strict input sanitization and parameterized queries for the DeptIDList parameter, or restrict network access to the vulnerable endpoint until an official patch is released by the vendor.

Proactive Monitoring: Monitor database query logs for unusual patterns, long delays, or error messages associated with the UserSel.aspx endpoint and unexpected database account activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block common SQL injection signatures directed at the /C6/JHSoft.Web.PlanSummarize/UserSel.aspx path.

Public Exploit Available: Yes, a published proof-of-concept exists via referenced security write-ups on GitHub.

Administrators should treat this vulnerability with high urgency due to the availability of proof-of-concept material and the lack of responsive vendor patching. Apply network-level restrictions and Web Application Firewall rules immediately to block unauthenticated requests to the vulnerable component until an official software update becomes available.