This vulnerability in Jinher OA C6 involves an SQL injection via the queryID parameter in the /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx file. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the backend database. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vendor was contacted but did not provide any response or fix. No patch or mitigation guidance is currently available from the vendor.

Successful exploitation allows an attacker to perform SQL injection attacks remotely, which can lead to unauthorized access or manipulation of the database. The CVSS score indicates a medium level of risk, reflecting the potential for partial confidentiality, integrity, and availability impacts. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying general SQL injection mitigations such as input validation and web application firewalls as temporary measures. Monitor vendor channels for updates or patches.