CVE-2026-2963: Jinher OA C6 SQL Injection Vulnerability

CVE-2026-2963 Overview

A SQL injection vulnerability has been identified in Jinher OA C6, a Chinese office automation system, in versions up to 20260210. The vulnerability exists in the file /C6/Jhsoft.Web.officesupply/OfficeSupplyTypeRight.aspx where the id and offsnum parameters are susceptible to SQL injection attacks. This flaw allows remote authenticated attackers to inject malicious SQL statements, potentially leading to unauthorized data access, data modification, or complete database compromise.

Critical Impact

Remote attackers with low privileges can exploit this SQL injection vulnerability to extract sensitive data, modify database contents, or potentially escalate privileges within the Jinher OA C6 system. The exploit has been publicly disclosed.

Affected Products

• Jinher OA C6 up to version 20260210
• Jinher OA C6 installations with /C6/Jhsoft.Web.officesupply/OfficeSupplyTypeRight.aspx endpoint exposed

Discovery Timeline

• February 23, 2026 - CVE-2026-2963 published to NVD
• February 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2963

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), specifically manifesting as a SQL injection flaw. The affected endpoint OfficeSupplyTypeRight.aspx in the Jinher OA C6 office supply management module fails to properly sanitize user-supplied input before incorporating it into SQL queries.

The attack can be initiated remotely over the network and requires low privileges to execute. When exploited, this vulnerability allows attackers to manipulate database queries, potentially leading to unauthorized data disclosure, data manipulation, and in severe cases, complete database server compromise.

The vendor was contacted regarding this vulnerability but did not respond, leaving systems potentially unpatched. The exploit details have been publicly disclosed, increasing the risk of active exploitation.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization of the id and offsnum parameters in the OfficeSupplyTypeRight.aspx page. User-controlled input is directly concatenated into SQL queries without adequate parameterization or escaping, allowing malicious SQL code to be injected and executed by the database server.

Attack Vector

The attack vector is network-based, allowing remote exploitation. An authenticated attacker with low-level access to the Jinher OA C6 system can manipulate the id or offsnum parameters in HTTP requests to the vulnerable endpoint. By crafting specially formatted input containing SQL syntax, the attacker can alter the intended query logic.

The exploitation mechanism involves injecting SQL commands through the vulnerable parameters. For example, an attacker could inject UNION-based payloads to extract data from other tables, time-based blind injection to enumerate database contents, or stacked queries to modify or delete data.

Technical details and proof-of-concept information are available in Ricky's Vulnerability Analysis and the VulDB entry.

Detection Methods for CVE-2026-2963

Indicators of Compromise

• Unusual SQL error messages in web server logs from requests to /C6/Jhsoft.Web.officesupply/OfficeSupplyTypeRight.aspx
• HTTP requests containing SQL keywords (UNION, SELECT, INSERT, DELETE, OR, AND) in the id or offsnum parameters
• Abnormal database query patterns or execution times
• Unexpected data modifications in office supply management tables

Detection Strategies

• Deploy web application firewall (WAF) rules to detect SQL injection patterns targeting the OfficeSupplyTypeRight.aspx endpoint
• Implement application-level logging for the affected endpoint and monitor for suspicious parameter values
• Use intrusion detection systems (IDS) with SQL injection signatures focused on ASP.NET applications
• Monitor database query logs for anomalous queries originating from the web application

Monitoring Recommendations

• Enable verbose logging on web servers hosting Jinher OA C6 instances
• Implement real-time alerting for requests containing common SQL injection patterns
• Monitor database activity for unauthorized data access or schema enumeration attempts
• Review access logs for repeated requests to the vulnerable endpoint from unusual IP addresses

How to Mitigate CVE-2026-2963

Immediate Actions Required

• Restrict network access to the /C6/Jhsoft.Web.officesupply/OfficeSupplyTypeRight.aspx endpoint to trusted IP addresses only
• Deploy WAF rules to block SQL injection attempts targeting the id and offsnum parameters
• Consider disabling the office supply module if not critical to operations
• Implement additional authentication requirements for the affected endpoint
• Monitor logs for any signs of exploitation attempts

Patch Information

The CVE description recommends installing a patch to address this issue. However, the vendor (Jinher) was contacted about this disclosure but did not respond. Users should check for security updates from Jinher and apply any available patches immediately. If no official patch is available, implement the workarounds listed below.

Additional vulnerability details can be found in the VulDB CTI Report and the VulDB submission.

Workarounds

• Implement input validation at the application layer to filter SQL metacharacters from the id and offsnum parameters
• Deploy a reverse proxy or WAF with SQL injection protection rules in front of the Jinher OA C6 application
• Restrict database user privileges for the web application to minimize the impact of successful exploitation
• Isolate the Jinher OA C6 system in a network segment with strict access controls

# Example WAF rule configuration for blocking SQL injection (ModSecurity)
SecRule ARGS:id|ARGS:offsnum "@detectSQLi" \
    "id:1001,\
    phase:2,\
    block,\
    msg:'SQL Injection attempt detected on OfficeSupplyTypeRight.aspx',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL',\
    t:none,t:urlDecodeUni"