This vulnerability in Jinher OA 1.0 arises from improper input validation of the DeptIDList parameter in the UserSel.aspx file, leading to SQL injection. An attacker can remotely manipulate this parameter to execute arbitrary SQL commands on the backend database. The vendor has not provided any fix or advisory, and no official remediation is currently available. Exploit code has been published, increasing the risk of exploitation despite the medium severity rating.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the affected system's database. This may lead to unauthorized data access, modification, or other database impacts depending on the database privileges of the application. The lack of vendor response and published exploit code increases the risk of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation has been provided by the vendor, users should consider implementing compensating controls such as input validation, web application firewalls, or restricting access to the vulnerable endpoint until a patch is available.