CVE-2025-10092
📋 TL;DR
This CVE describes an XML External Entity (XXE) vulnerability in Jinher OA software up to version 1.2. Attackers can exploit this to read sensitive files, conduct server-side request forgery, or potentially execute code by manipulating XML input. Organizations using Jinher OA versions up to 1.2 with the vulnerable XML handler component are affected.
💻 Affected Systems
- Jinher OA
📦 What is this software?
Jinher Oa by Jinher
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers could read sensitive files (including configuration files with credentials), conduct SSRF attacks against internal systems, or potentially achieve remote code execution depending on system configuration.
Likely Case
Attackers will likely exfiltrate sensitive configuration files, credentials, or conduct SSRF attacks against internal services accessible from the vulnerable server.
If Mitigated
With proper network segmentation and XML parser hardening, impact is limited to information disclosure from files accessible to the web server process.
🎯 Exploit Status
The exploit has been made public according to the CVE description, and XXE vulnerabilities typically have low exploitation complexity with available tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check with Jinher for security updates or consider upgrading to a newer version if available.
🔧 Temporary Workarounds
Disable XXE in XML parser
allConfigure the XML parser to disable external entity processing
Modify application configuration to set XML parser properties: FEATURE_SECURE_PROCESSING = true, disallow-doctype-decl = true
Input validation and sanitization
allImplement strict input validation to reject XML containing external entity declarations
Implement XML schema validation or regex filtering for XXE patterns
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with XXE protection rules
- Restrict network access to the vulnerable endpoint using firewall rules or network segmentation
🔍 How to Verify
Check if Vulnerable:
Test the endpoint /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add with XXE payloads using tools like XXEinjector or manually crafted XML with external entitiesCheck Version:
Check Jinher OA version in application interface or configuration filesVerify Fix Applied:
Retest with XXE payloads after implementing workarounds to ensure they no longer succeed📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors
- Requests to /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx with XML content
- Outbound connections from web server to unexpected internal systems
Network Indicators:
- HTTP requests containing XML with DOCTYPE declarations or external entity references
- Unusual outbound connections from web server following XXE exploitation
SIEM Query:
source="web_server" AND (uri="/c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx" OR content="<!DOCTYPE" OR content="%" OR content="SYSTEM")