This vulnerability in Jinher OA 1.0 involves SQL injection through the httpOID parameter in the nextselectplan.aspx file. An attacker can remotely manipulate this argument to execute unauthorized SQL commands on the backend database. The CVSS 4.0 base score is 6.9, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The vendor has not provided a fix or advisory, and no patch links are available.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing application-level mitigations such as input validation and web application firewalls to detect and block SQL injection attempts until a vendor patch is released.