CVE-2025-10090
published 2025-09-08CVE-2025-10090: A flaw has been found in Jinher OA up to 1.2. The impacted element is an unknown function of the file /C6/Jhsoft.Web.departments/GetTreeDate.aspx. Executing…
PriorityP178critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
1.66%
73.8th percentile
A flaw has been found in Jinher OA up to 1.2. The impacted element is an unknown function of the file /C6/Jhsoft.Web.departments/GetTreeDate.aspx. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jinher | jinher_oa | <= 1.2 | — |
| jinher | oa | — | — |
| jinher | oa | — | — |
| jinher | oa | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/C6/Jhsoft.Web.departments/GetTreeDate.aspx/?id=1;WAITFOR+DELAY+'0:0:6'--
commandid=1;WAITFOR+DELAY+'0:0:6'--
- →Time-based SQL injection: detect requests to GetTreeDate.aspx with a WAITFOR DELAY payload in the 'id' parameter; a response duration >= 6 seconds indicates successful exploitation.
- →FOFA query to identify exposed Jinher OA instances: app="金和网络-金和OA" or body containing '/jc6/platform/sys/login'.
- ·The vulnerability affects Jinher OA up to version 1.2; the attack requires no authentication (PR:N, UI:N) and is remotely exploitable. ↗
- ·The Nuclei template uses a 10-second HTTP timeout to accommodate the 6-second WAITFOR DELAY; tune detection thresholds accordingly to avoid false negatives on slow networks.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck6.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4q35-hvg6-q7wv: A flaw has been found in Jinher OA up to 1
ghsa_unreviewed·2025-09-08
CVE-2025-10090 [MEDIUM] CWE-74 GHSA-4q35-hvg6-q7wv: A flaw has been found in Jinher OA up to 1
A flaw has been found in Jinher OA up to 1.2. The impacted element is an unknown function of the file /C6/Jhsoft.Web.departments/GetTreeDate.aspx. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
VulnCheck
jinher jinher_oa Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
vulncheck·2025·CVSS 6.9
CVE-2025-10090 [MEDIUM] jinher jinher_oa Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
jinher jinher_oa Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
A flaw has been found in Jinher OA up to 1.2. The impacted element is an unknown function of the file /C6/Jhsoft.Web.departments/GetTreeDate.aspx. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
Affected: jinher jinher_oa
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://tracker.crowdsec.net/cves/CVE-2025-10090
No detection rules found.
Nuclei
Jinher OA - SQL Injection
nuclei·CVSS 6.9
CVE-2025-10090 [MEDIUM] Jinher OA - SQL Injection
Jinher OA - SQL Injection
jinher jinher_oa is an office automation software that facilitates workflow management and collaboration within organizations. It sits in the enterprise layer of the tech stack, is typically deployed as self_hosted, and—within the information_technology industry—serves the business_apps domain.
Template:
id: CVE-2025-10090
info:
name: Jinher OA - SQL Injection
author: DhiyaneshDk
severity: high
description: |
jinher jinher_oa is an office automation software that facilitates workflow management and collaboration within organizations. It sits in the enterprise layer of the tech stack, is typically deployed as self_hosted, and—within the information_technology industry—serves the business_apps domain.
impact: |
Remote attackers can execute arbitrary SQL commands
2025-09-08
Published
Exploited in the wild