This vulnerability in Jinher OA 1.0 involves SQL injection via the httpOID parameter in the attendance_out_approve.aspx file. An attacker can remotely manipulate this argument to inject SQL commands, potentially compromising the database. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. The vendor has not provided a fix or response, and no patch is currently known.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated as medium severity with limited confidentiality, integrity, and availability impact according to the CVSS vector. There is no confirmed active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the httpOID parameter as a temporary mitigation. Monitor for updates from the vendor regarding patches or official mitigations.