CVE-2026-15517 Details

A SQL injection vulnerability has been identified in Jinher OA version 1.0, specifically within the PlanGiveOut.aspx file. The issue arises from the httpOID parameter, which is improperly sanitized before being incorporated into SQL queries. This flaw allows remote attackers to inject arbitrary SQL commands into the backend database. The vulnerability can be exploited without authentication by sending specially crafted HTTP requests to the affected endpoint.

To address this vulnerability, it is recommended to implement parameterized queries using prepared statements, apply strict input validation and filtering for all user inputs, enforce the principle of least privilege for database accounts, conduct a comprehensive code security audit, deploy a web application firewall as temporary protection, and perform regular security testing and penetration testing.