CVE-2026-7670: Jinher OA 1.0 SQL Injection Vulnerability

CVE-2026-7670 Overview

CVE-2026-7670 is a SQL injection vulnerability in Jinher OA 1.0. The flaw resides in an unknown function within the /C6/JHSoft.Web.PlanSummarize/UserSel.aspx file. Attackers manipulate the DeptIDList parameter to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely without authentication or user interaction. A public exploit has been disclosed, increasing the risk of opportunistic attacks against exposed instances. The vendor was contacted prior to disclosure but did not respond, and no official patch has been released. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Remote unauthenticated attackers can inject SQL commands through the DeptIDList parameter to read, modify, or delete database contents in Jinher OA 1.0 deployments.

Affected Products

• Jinher OA 1.0
• Component: /C6/JHSoft.Web.PlanSummarize/UserSel.aspx
• Vulnerable parameter: DeptIDList

Discovery Timeline

• 2026-05-02 - CVE-2026-7670 published to NVD
• 2026-05-04 - Last updated in NVD database

Technical Details for CVE-2026-7670

Vulnerability Analysis

The vulnerability is a SQL injection flaw in the UserSel.aspx page of the Jinher OA 1.0 web application. The application accepts the DeptIDList argument from HTTP requests and concatenates it into a SQL query without proper sanitization or parameterization. An attacker who supplies crafted input can break out of the intended query context and execute arbitrary SQL statements against the underlying database. Successful exploitation can lead to disclosure of sensitive organizational data, modification of records, and potential lateral movement within the application's data tier. The EPSS data indicates a low near-term exploitation probability, but the public availability of exploit details elevates operational risk for any internet-exposed deployment.

Root Cause

The root cause is improper neutralization of user-supplied input passed through the DeptIDList parameter. The application fails to use parameterized queries or input validation routines before constructing SQL statements. This allows attacker-controlled data to be interpreted as SQL syntax rather than as inert query values. The weakness aligns with [CWE-74], reflecting an injection class flaw where untrusted input flows directly into a downstream interpreter.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to /C6/JHSoft.Web.PlanSummarize/UserSel.aspx with a malicious DeptIDList value. Because no privileges or user interaction are required, attackers can automate exploitation against exposed Jinher OA endpoints. Refer to the VulDB Vulnerability Detail and GitHub Issue Discussion for technical documentation of the injection path.

No verified exploit code is reproduced here. Public technical details are available through the references above.

Detection Methods for CVE-2026-7670

Indicators of Compromise

• HTTP requests targeting /C6/JHSoft.Web.PlanSummarize/UserSel.aspx containing SQL metacharacters such as single quotes, UNION SELECT, --, or ; in the DeptIDList parameter.
• Web server logs showing unusually long or encoded DeptIDList values from external IP addresses.
• Database error messages or stack traces returned in HTTP responses to requests containing the DeptIDList argument.

Detection Strategies

• Inspect IIS and application logs for anomalous query strings and POST bodies referencing DeptIDList.
• Deploy web application firewall (WAF) signatures that match common SQL injection payloads against the affected endpoint.
• Correlate authentication-free requests to UserSel.aspx with subsequent unusual database query patterns or volume spikes.

Monitoring Recommendations

• Enable detailed HTTP request logging on Jinher OA web servers and forward logs to a centralized SIEM for retention and analysis.
• Monitor SQL Server audit logs for unexpected schema enumeration, INFORMATION_SCHEMA access, or large result sets originating from the OA application account.
• Alert on outbound network connections from the database tier that could indicate exfiltration following successful injection.

How to Mitigate CVE-2026-7670

Immediate Actions Required

• Restrict access to the Jinher OA application to trusted internal networks or VPN users until a vendor fix is available.
• Block external HTTP requests to /C6/JHSoft.Web.PlanSummarize/UserSel.aspx at the network perimeter or reverse proxy.
• Audit database accounts used by Jinher OA and reduce privileges to the minimum required for application functionality.

Patch Information

No vendor patch is available at the time of disclosure. The vendor was contacted but did not respond. Operators should monitor the VulDB Vulnerability Detail and the GitHub Issue Discussion for patch availability and additional technical guidance.

Workarounds

• Deploy WAF rules that filter SQL metacharacters and known injection payloads on the DeptIDList parameter.
• Apply virtual patching at the reverse proxy to reject requests where DeptIDList does not match an expected numeric or comma-separated identifier pattern.
• Increase logging verbosity on the database tier and review queries originating from the application account for signs of exploitation.

# Example NGINX rule to block suspicious DeptIDList values
location /C6/JHSoft.Web.PlanSummarize/UserSel.aspx {
    if ($arg_DeptIDList ~* "('|\"|;|--|union|select|insert|update|delete|drop|exec)") {
        return 403;
    }
    proxy_pass http://jinher_oa_backend;
}