A vulnerability, which was classified as critical, was found in Jinher OA C6 1.0. This affects an unknown part of the file IncentivePlanFulfillAppprove.aspx. The manipulation of the argument httpOID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
References
| Link | Resource |
|---|---|
| https://flowus.cn/share/75512a54-e78f-4bfb-80e7-236521b43a02?code=HC3R4E | Exploit |
| https://flowus.cn/share/75512a54-e78f-4bfb-80e7-236521b43a02?code=HC3R4E | Exploit |
| https://vuldb.com/?ctiid.300567 | Permissions Required |
| https://vuldb.com/?id.300567 | Third Party Advisory |
| https://vuldb.com/?submit.516025 | Third Party Advisory |
Configurations
History
01 Apr 2025, 20:24
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://vuldb.com/?id.300567 - Third Party Advisory | |
| References | () https://vuldb.com/?submit.516025 - Third Party Advisory | |
| References | () https://flowus.cn/share/75512a54-e78f-4bfb-80e7-236521b43a02?code=HC3R4E - Exploit | |
| References | () https://vuldb.com/?ctiid.300567 - Permissions Required | |
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.3 |
| CPE | cpe:2.3:a:jinher:jinher_oa_c6:1.0:*:*:*:*:*:*:* | |
| First Time |
Jinher jinher Oa C6
Jinher |
21 Mar 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : unknown |
| CWE | CWE-74 |
21 Mar 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-21 12:15
Updated : 2025-04-01 20:24
NVD link : CVE-2025-2587
Mitre link : CVE-2025-2587
JSON object : View
Products Affected
jinher
- jinher_oa_c6
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')