This vulnerability involves an SQL injection in Jinher OA C6 within an unspecified function in the /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx endpoint. Manipulating the queryID parameter can lead to injection of SQL commands, potentially compromising the database. The attack vector is remote network access with low complexity and no user interaction required. The vendor has not issued any advisory or fix, and the exploit code is publicly available.

Successful exploitation could allow an attacker to execute unauthorized SQL commands on the backend database, potentially leading to data leakage, modification, or disruption of service. The CVSS 4.0 base score of 5.3 indicates a medium impact with limited scope and privileges required. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing application-level mitigations such as input validation, parameterized queries, or web application firewalls to reduce risk until an official patch is available.