CVE-2026-15517 identifies a SQL injection vulnerability in Jinher OA 1.0. The flaw exists in an unknown function in the PlanGiveOut.aspx file, where the httpOID argument is improperly sanitized, allowing an attacker to inject SQL commands remotely without any privileges or user interaction. Although an exploit has been published, there is no vendor response or official fix available at this time. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.9.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary SQL commands on the backend database of Jinher OA 1.0. This could lead to unauthorized data access, modification, or deletion depending on the database permissions. The vulnerability does not require authentication or user interaction, increasing its risk. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fix is published, users should consider applying manual input validation or filtering on the httpOID parameter as a temporary mitigation. Monitoring for unusual database queries and restricting database permissions may reduce impact. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.