CVE-2026-15517: Jinher OA 1.0 SQL Injection Vulnerability

CVE-2026-15517 Overview

CVE-2026-15517 is a SQL injection vulnerability in Jinher OA 1.0 affecting the /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx endpoint. The flaw resides in the handling of the httpOID parameter, which is passed directly into a database query without sanitization. Remote attackers can exploit the issue over the network without authentication or user interaction. Public exploit details have been released, and the vendor did not respond to disclosure attempts.

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL through the httpOID parameter, enabling data disclosure, tampering, and potential integrity impact on the Jinher OA backend database.

Affected Products

Jinher OA 1.0
/C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx endpoint
Deployments exposing the affected endpoint via HTTP/HTTPS

Discovery Timeline

2026-07-13 - CVE-2026-15517 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15517

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected component is the PlanGiveOut.aspx handler inside the JHSoft.Web.PlanSummarize module of Jinher OA 1.0. The httpOID request argument is concatenated into a backend SQL statement without parameterization or input validation.

An attacker can send a crafted HTTP request that appends SQL syntax to the httpOID value. The database engine executes the injected fragment as part of the intended query. This yields impacts on confidentiality, integrity, and availability of stored data. Because the endpoint is reachable pre-authentication, exploitation requires only network access to the affected application.

Root Cause

The root cause is insufficient input neutralization of the httpOID argument before it reaches the SQL query builder. The application trusts the client-supplied value and interpolates it into the query string. Parameterized queries or stored procedures with bound parameters would prevent the injection.

Attack Vector

Exploitation occurs over the network against the /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx endpoint. The attacker crafts an HTTP GET or POST request containing malicious SQL fragments in the httpOID parameter. No authentication, privileges, or user interaction are required. Public proof-of-concept material has been referenced through the GitHub CVE Issue Tracker and VulDB entry for CVE-2026-15517.

The vulnerability manifests when the httpOID value is concatenated into a dynamic SQL statement. See the referenced advisories for technical proof-of-concept details.

Detection Methods for CVE-2026-15517

Indicators of Compromise

HTTP requests to /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx containing SQL metacharacters such as ', --, UNION, SELECT, SLEEP, or WAITFOR in the httpOID parameter.
Web server logs showing unusually long httpOID values or repeated requests from a single source enumerating parameter payloads.
Database error messages, unexpected query latency, or anomalous row counts correlated with requests to the affected endpoint.

Detection Strategies

Deploy web application firewall (WAF) signatures targeting SQL injection patterns on the httpOID argument of the PlanGiveOut.aspx path.
Enable SQL query logging on the backend database and alert on syntactically anomalous statements referencing tables used by the plan summarize module.
Correlate IIS or reverse proxy access logs with database audit logs to identify injection attempts that reach query execution.

Monitoring Recommendations

Monitor outbound traffic from the Jinher OA application server for unexpected data exfiltration volumes following requests to the vulnerable endpoint.
Track authentication anomalies and privilege changes in the OA database that may follow successful injection.
Baseline normal httpOID values and alert on deviations in length, character set, or request frequency.

How to Mitigate CVE-2026-15517

Immediate Actions Required

Restrict network access to /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx using firewall or reverse proxy allowlists until a vendor patch is available.
Deploy WAF rules that block SQL injection payloads in the httpOID parameter.
Review database audit logs for evidence of prior exploitation and rotate credentials stored in the OA database.

Patch Information

No vendor patch is currently available. The vendor was contacted about this disclosure but did not respond, according to the VulDB entry for CVE-2026-15517. Administrators should monitor the vendor for future updates and apply compensating controls in the interim.

Workarounds

Place the Jinher OA application behind a reverse proxy that enforces strict input validation on the httpOID parameter, rejecting non-numeric or non-expected values.
Apply least-privilege database roles so the OA application account cannot read sensitive tables or execute administrative statements.
Disable or remove the PlanGiveOut.aspx endpoint if it is not required for business operations.

bash

# Example NGINX rule to block SQL metacharacters in the httpOID parameter
location /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx {
    if ($arg_httpOID ~* "('|--|;|union|select|sleep|waitfor)") {
        return 403;
    }
    proxy_pass http://jinher_oa_backend;
}