{"id":"CVE-2026-124331","kind":"vulnerability","aliases":["CVE-2026-124331"],"related":[],"title":"Jinher OA C6: SQL injection through the ProjID parameter lets attackers query data","description":"A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Jinher OA C6's ProjectAfficheManage.aspx concatenates the ProjID parameter into SQL, allowing SQL injection on Microsoft SQL Server. A public PoC exists, the researcher says no login is needed, and the vendor has not responded or released a fix.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Jinher OA C6","fixed":[],"affected":"unknown (researcher lists V1.0; NVD lists C6)","ecosystem":"vendor"}],"ecosystems":[],"tags":["asp.net","jinher-oa","on-premise","other","sql-server","unauthenticated"],"not_affected_if":["not-internet-exposed","unknown"],"how_to_check":"Check whether Jinher OA C6 is installed and whether /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx answers on your network. Look in web server logs for requests to that path with ProjID values containing ';', WAITFOR or quotes. Affected version range is unknown.","fix":"No fix: VulDB says the vendor did not respond to disclosure. No patched version known.","status":"open","published_at":"2026-11-08T14:18:07+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","triaged_at":"2026-11-08T14:49:20+00:00","updated_at":"2026-11-08T14:50:26+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-08T14:49:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Jinher OA C6: SQL injection through the ProjID parameter lets attackers query data","impact":"high","summary":"Jinher OA C6, an office administration product, fails to sanitize the ProjID argument in a project page, which allows SQL injection. A remote attacker can use it to read or change data in the backing database, and a public exploit exists.","audience":"businesses","category":"other","nicknames":[],"who_cares":["jinher-oa","asp.net","sql-server","on-premise"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads or alters database contents remotely","analyst_note":"Confirm affected Jinher OA C6 versions, whether the page needs login, and whether any vendor or patch exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124331.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organisations running Jinher OA C6 with the OfficeReadOnly ProjectAfficheManage.aspx page reachable from their network. The sources do not say which versions are affected or whether the page is exposed by default. The vendor did not respond to disclosure, so no fixed version is known.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000709,"input_tokens":4579,"output_tokens":503,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Jinher OA C6 versions, whether the page needs login, and whether any vendor or patch exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124331.","search":"'-124331':16A,19A '-2026':15A,18A '/c6/jhsoft.web.project/officereadonly/projectaffichemanage.aspx':90C 'allow':46B 'argument':95C 'asp.net':23B 'attack':11A,107C 'avail':113C 'c6':3A,22A,37B,81C 'concaten':40B 'contact':121C 'cve':14A,17A 'data':13A 'disclosur':125C 'earli':122C 'exist':56B 'exploit':110C 'file':89C 'fix':73B 'function':86C 'identifi':77C 'impact':83C 'inject':5A,48B,100C 'jinher':1A,20A,25B,35B,79C 'jinher-oa':24B 'launch':105C 'lead':97C 'let':10A 'login':61B 'manipul':92C 'microsoft':50B 'might':115C 'need':63B 'oa':2A,21A,26B,36B,80C 'on-premis':27B 'paramet':9A,43B 'poc':55B 'possibl':103C 'premis':29B 'projectaffichemanage.aspx':39B 'projid':8A,42B,96C 'public':54B,112C 'queri':12A 'releas':71B 'remot':108C 'research':58B 'respond':69B,129C 'say':59B 'server':33B,52B 'sql':4A,32B,45B,47B,51B,99C 'sql-server':31B 'unauthent':34B 'unknown':85C 'use':117C 'vendor':66B,119C 'vulner':75C 'way':132C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Jinher OA C6 (ASP.NET on Microsoft SQL Server) where ProjectAfficheManage.aspx can be reached. The researcher's report says no login is needed, and its PoC is a plain GET request with a time-delay payload on ProjID; this was not confirmed by the vendor. The researcher lists version V1.0, and NVD lists only 'C6', so the range is unknown. Teams not running Jinher OA, or with it unreachable from untrusted networks, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["jinheroac6","oac6"],"ptokens":["c6","jinher","oa"],"labels":["aspnet","high","jinheroa","onpremise","other","sqlserver","unauthenticated"],"campaign_type":null,"search_a":"'-124331':16A,19A '-2026':15A,18A 'attack':11A 'c6':3A,22A 'cve':14A,17A 'data':13A 'inject':5A 'jinher':1A,20A 'let':10A 'oa':2A,21A 'paramet':9A 'projid':8A 'queri':12A 'sql':4A","search_b":"'allow':46B 'asp.net':23B 'c6':37B 'concaten':40B 'exist':56B 'fix':73B 'inject':48B 'jinher':25B,35B 'jinher-oa':24B 'login':61B 'microsoft':50B 'need':63B 'oa':26B,36B 'on-premis':27B 'paramet':43B 'poc':55B 'premis':29B 'projectaffichemanage.aspx':39B 'projid':42B 'public':54B 'releas':71B 'research':58B 'respond':69B 'say':59B 'server':33B,52B 'sql':32B,45B,47B,51B 'sql-server':31B 'unauthent':34B 'vendor':66B","search_c":"'/c6/jhsoft.web.project/officereadonly/projectaffichemanage.aspx':90C 'argument':95C 'attack':107C 'avail':113C 'c6':81C 'contact':121C 'disclosur':125C 'earli':122C 'exploit':110C 'file':89C 'function':86C 'identifi':77C 'impact':83C 'inject':100C 'jinher':79C 'launch':105C 'lead':97C 'manipul':92C 'might':115C 'oa':80C 'possibl':103C 'projid':96C 'public':112C 'remot':108C 'respond':129C 'sql':99C 'unknown':85C 'use':117C 'vendor':119C 'vulner':75C 'way':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T14:18:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-124331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124331","severity":null,"published_at":"2026-11-08T14:18:07+00:00","modified_at":"2026-11-08T14:18:07+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","fetched_at":"2026-11-08T14:48:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124331:2184","url":"https://github.com/wangpenglei11/Submit/issues/2","severity":null,"published_at":"2026-11-08T14:50:26+00:00","modified_at":"2026-11-08T14:50:26+00:00","first_seen_at":"2026-11-08T14:50:26+00:00","fetched_at":"2026-11-08T14:50:26+00:00","note":"Primary vendor source absent: vendor silent per VulDB/NVD. PoC in researcher GitHub issue (unauth GET, ProjID, MSSQL time-based) linked. No exploitation in the wild known. Nothing verified.","cites":["https://github.com/wangpenglei11/Submit/issues/2","https://vuldb.com/vuln/432651"]}],"documents":[{"id":102183,"url":"https://github.com/wangpenglei11/Submit/issues/2","title":"Jinher OA SQL Injection Vulnerability Report (ProjID)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":102184,"url":"https://vuldb.com/vuln/432651","title":"VDB-432651 Jinher OA C6 ProjectAfficheManage.aspx ProjID sql injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://github.com/wangpenglei11/Submit/issues/2"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}