CVE-2025-10090
📋 TL;DR
This CVE describes a SQL injection vulnerability in Jinher OA software up to version 1.2, specifically in the GetTreeDate.aspx file. Attackers can manipulate the ID parameter to execute arbitrary SQL commands, potentially compromising the database. Organizations using Jinher OA versions up to 1.2 are affected.
💻 Affected Systems
- Jinher OA
📦 What is this software?
Jinher Oa by Jinher
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access, extraction of sensitive information, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
The exploit has been published and requires minimal technical skill to execute. Remote exploitation is possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check with Jinher for security updates beyond version 1.2.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the GetTreeDate.aspx endpoint.
Input Validation Filter
windowsAdd server-side input validation to sanitize the ID parameter before processing.
🧯 If You Can't Patch
- Isolate the Jinher OA system from the internet using network segmentation.
- Implement strict access controls and monitor all database queries from the application.
🔍 How to Verify
Check if Vulnerable:
Test the /C6/Jhsoft.Web.departments/GetTreeDate.aspx endpoint with SQL injection payloads in the ID parameter.Check Version:
Check the Jinher OA application version in the admin interface or configuration files.Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and that parameterized queries are implemented.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in web logs
Network Indicators:
- HTTP requests to GetTreeDate.aspx with SQL injection patterns in parameters
SIEM Query:
source="web_logs" AND uri="/C6/Jhsoft.Web.departments/GetTreeDate.aspx" AND (param="ID" AND value CONTAINS "' OR '1'='1" OR value CONTAINS "UNION SELECT" OR value CONTAINS "EXEC(")