---
id: "CVE-2026-124331"
page: "https://infrastack.ai/live/CVE-2026-124331"
kind: "vulnerability"
aliases: ["CVE-2026-124331"]
title: "Jinher OA C6: SQL injection through the ProjID parameter lets attackers query data"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Jinher OA C6", "fixed": [], "affected": "unknown (researcher lists V1.0; NVD lists C6)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["asp.net", "jinher-oa", "on-premise", "other", "sql-server", "unauthenticated"]
not_affected_if: ["not-internet-exposed", "unknown"]
published_at: "2026-11-08T14:18:07+00:00"
first_seen_at: "2026-11-08T14:48:38+00:00"
updated_at: "2026-11-08T14:50:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124331", "first_seen_at": "2026-11-08T14:48:38+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/432651", "first_seen_at": "2026-11-08T14:50:26+00:00", "cites": ["https://vuldb.com/vuln/432651", "https://github.com/wangpenglei11/Submit/issues/2"]}]
exploit_sources: [{"type": "poc", "url": "https://github.com/wangpenglei11/Submit/issues/2"}]
---

# Jinher OA C6: SQL injection through the ProjID parameter lets attackers query data

Link for people: https://infrastack.ai/live/CVE-2026-124331 (this .md is for agents)

Jinher OA C6's ProjectAfficheManage.aspx concatenates the ProjID parameter into SQL, allowing SQL injection on Microsoft SQL Server. A public PoC exists, the researcher says no login is needed, and the vendor has not responded or released a fix.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Jinher OA C6 affected unknown (researcher lists V1.0; NVD lists C6) fixed no fixed version listed

## How to check

Check whether Jinher OA C6 is installed and whether /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx answers on your network. Look in web server logs for requests to that path with ProjID values containing ';', WAITFOR or quotes. Affected version range is unknown.

## Fix

No fix: VulDB says the vendor did not respond to disclosure. No patched version known.

## Timeline

- 2026-11-08T14:48:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124331
- 2026-11-08T14:50:26+00:00 analyst https://vuldb.com/vuln/432651 — Primary vendor source absent: vendor silent per VulDB/NVD. PoC in researcher GitHub issue (unauth GET, ProjID, MSSQL time-based) linked. No exploitation in the wild known. Nothing verified.

## Documents

- [advisory] VDB-432651 Jinher OA C6 ProjectAfficheManage.aspx ProjID sql injection https://vuldb.com/vuln/432651
- [poc] Jinher OA SQL Injection Vulnerability Report (ProjID) https://github.com/wangpenglei11/Submit/issues/2

## From the sources

A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_