Description
A vulnerability was determined in Jinher OA C6 up to 20260210. This issue affects some unknown processing of the file /C6/Jhsoft.Web.officesupply/OfficeSupplyTypeRight.aspx. This manipulation of the argument id/offsnum causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jinher | OA C6 | 20260210 | — |
References
- VDB-347330 | Jinher OA C6 OfficeSupplyTypeRight.aspx sql injection vdb-entry technical-description
- VDB-347330 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #755216 | Jinher C6 v1.0 SQL Injection third-party-advisory
- https://vuln.ricky.place/Jinher/C6/ exploit