CVE-2026-11435: SQL Injection in Jinher OA 1.0 – Unauthenticated Remote Code Access

Technical summary

CVE-2026-11435 is a SQL injection flaw (CWE-89) affecting Jinher OA 1.0's nextselectplan.aspx endpoint. The vulnerability stems from insufficient input validation on the httpOID argument, allowing an unauthenticated remote attacker to construct queries that access, modify, or delete database records. The CVSS v3.1 score of 7.3 reflects the network-accessible nature (AV:N) and lack of required privileges (PR:N), combined with moderate impact across confidentiality, integrity, and availability (C:L/I:L/A:L). Public disclosure and vendor non-response escalate operational risk.

Business impact

Organizations running Jinher OA 1.0 face immediate risk of unauthorized database access, potential data exfiltration, and system compromise without authentication barriers. The publicly disclosed exploit means attackers can readily weaponize this vulnerability. Business continuity depends on rapid remediation, as attackers could modify or delete mission-critical records stored in the OA system, disrupt document workflows, and compromise employee and customer data.

Affected systems

Jinher OA version 1.0 is confirmed vulnerable. The exact scope of affected deployments and whether later versions have patched this issue requires verification against Jinher's official advisory. Organizations should inventory all Jinher OA instances and confirm their version numbers immediately.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no user interaction, and no complex prerequisites—only network access to the nextselectplan.aspx endpoint. The CVSS Access Vector (AV:N) and Attack Complexity (AC:L) indicate straightforward remote exploitation. Public disclosure means exploit tooling and proof-of-concept code are likely available, accelerating threat actor adoption. The vendor's apparent non-responsiveness eliminates coordinated disclosure protections.

Remediation

Immediately contact Jinher for patches or upgrade guidance. If no official patch is available, consider blocking external access to nextselectplan.aspx via web application firewall rules or network segmentation until a fix is released. Input validation and parameterized queries should be implemented on the httpOID parameter. Organizations unable to patch should disable or isolate the affected OA deployment.

Patch guidance

Verify the latest security advisory from Jinher to confirm available patch versions and upgrade procedures. Organizations should prioritize deployment of any patch addressing CVE-2026-11435 before restoring full network access. Until patched, restrict administrative and external access to the Jinher OA instance. Test patches in a non-production environment first to ensure workflow continuity.

Detection guidance

Monitor web server and application logs for requests to nextselectplan.aspx containing suspicious SQL syntax or encoded payloads in the httpOID parameter. Look for patterns such as UNION SELECT, DROP TABLE, INSERT INTO, or encoded equivalents (e.g., %27, %3B). Implement network-level detection rules that flag anomalous SQL keywords in HTTP parameters. Database audit logs should be reviewed for unexpected query patterns or access by the OA application service account.

Why prioritize this

This vulnerability merits immediate attention due to: (1) network accessibility with no authentication required, (2) public availability of proof-of-concept code, (3) vendor non-responsiveness preventing coordinated disclosure, (4) direct database access potential, and (5) high CVSS score (7.3). Organizations should treat this as a critical remediation priority.

Risk score, explained

The CVSS v3.1 score of 7.3 (HIGH) reflects the combination of network accessibility, lack of authentication requirements, and measurable impact on data confidentiality, integrity, and availability. The score does not account for the elevated real-world risk posed by public exploit disclosure and vendor non-responsiveness; organizations should consider this vulnerability higher priority than the base CVSS alone suggests.

Frequently asked questions