JINHER OA C6 · CVE-2026-124331 · Other
NO FIX YET · SEE WHAT TO DO
Jinher OA C6's ProjectAfficheManage.aspx concatenates the ProjID parameter into SQL, allowing SQL injection on Microsoft SQL Server. A public PoC exists, the researcher says no login is needed, and the vendor has not responded or released a fix.
first public Nov 8, 2026 · 1 public exploit · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organisations running Jinher OA C6 (ASP.NET on Microsoft SQL Server) where ProjectAfficheManage.aspx can be reached. The researcher's report says no login is needed, and its PoC is a plain GET request with a time-delay payload on ProjID; this was not confirmed by the vendor. The researcher lists version V1.0, and NVD lists only 'C6', so the range is unknown. Teams not running Jinher OA, or with it unreachable from untrusted networks, can skip it.
Not affected if not-internet-exposed, unknown
Who cares asp.net, jinher-oa, on-premise, sql-server, unauthenticated
A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.