This vulnerability affects Jinher OA 1.0 and involves SQL injection via the DeptIDList parameter in the UserSel.aspx file under /C6/JHSoft.Web.PlanSummarize/. The flaw allows remote attackers to inject SQL commands due to insufficient input validation or sanitization of this argument. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The vendor has not issued any patch or advisory, and the exploit code is publicly available.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium based on CVSS 4.0 scoring, reflecting limited but significant confidentiality, integrity, and availability consequences. No evidence of exploitation in the wild has been reported yet.

No official patch or remediation is currently available from the vendor. Users should monitor vendor channels for updates. In the meantime, applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the DeptIDList parameter may reduce risk. Avoid exposing the vulnerable endpoint to untrusted networks if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.