CVE-2026-15517 describes a SQL injection vulnerability in Jinher OA 1.0. The flaw exists in an unknown function in the file /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx, where manipulation of the httpOID parameter allows injection of SQL commands. This vulnerability can be exploited remotely without any privileges or user interaction. Although the exploit code has been published, there is no vendor response or patch available at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a fix is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the httpOID parameter. Avoid exposing the vulnerable endpoint to untrusted networks if possible.