SQL Injection in Jinher OA Web Application Parameter

A security vulnerability has been detected in Jinher OA 1.0. This affects an unknown function of the file nextselectplan.aspx. Such manipulation of the argument httpOID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-11435 represents a critical SQL injection vulnerability in Jinher OA 1.0, specifically within the nextselectplan.aspx file where the httpOID parameter fails to properly sanitize user input. This vulnerability carries a CVSS score of 7.3 (high severity) and can be exploited remotely without authentication, making it particularly dangerous for organizations relying on Jinher OA for office automation tasks. The public disclosure and lack of vendor response compound the risk, leaving affected deployments vulnerable to immediate exploitation by threat actors seeking database access, credential theft, or lateral movement within enterprise networks.

Casky.ai's 301 matched security skills leverage Claude's extended reasoning to correlate this vulnerability with MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance - specifically resource development and initial access). Practitioners using Casky would observe detection findings aligned with CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection), identifying suspicious patterns such as SQL metacharacters in the httpOID parameter, abnormal query construction, and database error responses. The platform's skill mapping would highlight how attackers could exploit this for data exfiltration (T1020), execute arbitrary commands post-exploitation, or establish persistence—enabling security teams to prioritize this vulnerability in their patch management workflows and implement compensating controls like Web Application Firewalls targeting malicious parameter injection patterns.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-11435.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-11435

Casky has 301 skills that investigate the attack patterns behind CVE-2026-11435. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn