CVE-2025-7523
📋 TL;DR
This vulnerability in Jinher OA 1.0 allows attackers to perform XML External Entity (XXE) attacks through the /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx endpoint. This can lead to unauthorized data access, server-side request forgery, or denial of service. Organizations using Jinher OA 1.0 are affected.
💻 Affected Systems
- Jinher OA
📦 What is this software?
Jinher Oa by Jinher
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including sensitive data exfiltration, internal network reconnaissance, and potential remote code execution via XXE.
Likely Case
Unauthorized access to sensitive files on the server, disclosure of internal system information, and potential denial of service.
If Mitigated
Limited impact with proper XML parser hardening, network segmentation, and input validation in place.
🎯 Exploit Status
Public proof-of-concept available on GitHub demonstrates remote exploitation without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Disable XXE in XML parser
windowsConfigure XML parser to disable external entity processing
Set XmlResolver property to null in .NET XML parsers
Disable DTD processing in XML configuration
Block vulnerable endpoint
windowsRestrict access to /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx
Add URL rewrite rule in IIS to block the path
Configure firewall rules to block requests to this endpoint
🧯 If You Can't Patch
- Implement network segmentation to isolate Jinher OA systems
- Deploy web application firewall with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Test the /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx endpoint with XXE payloads from the public PoCCheck Version:
Check Jinher OA version in application interface or configuration filesVerify Fix Applied:
Verify XML parser configuration disables external entities and test endpoint with XXE payloads📡 Detection & Monitoring
Log Indicators:
- Unusual XML payloads in web server logs
- Requests to DelTemp.aspx with XML content
- Error logs showing XML parsing failures
Network Indicators:
- HTTP requests containing XML external entity declarations
- Outbound connections from server to unexpected external systems
SIEM Query:
source="web_server" AND (uri="*DelTemp.aspx" OR body="*<!ENTITY*")