SQL Injection in Jinher OA C6 Project Management Module

A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Jinher OA C6, a widely-deployed office automation platform, contains a critical SQL injection vulnerability in its ProjectAfficheManage.aspx component. The flaw exists in the ProjID parameter, allowing unauthenticated attackers to manipulate database queries remotely. This vulnerability affects organizations using Jinher OA C6 for project management and collaboration, potentially exposing sensitive project data, user credentials, and business intelligence. With a CVSS score of 7.3 and publicly available exploit code, this represents an immediate threat—particularly concerning given the vendor's unresponsiveness to early disclosure attempts, leaving no official patch available.

Casky's skill library, powered by Claude AI's extended reasoning capabilities, correlates 323 security techniques to detect the attack patterns underlying this CVE across MITRE ATT&CK's Initial Access (TA0001) and Persistence (TA0043) tactics. Practitioners using Casky would identify CWE-89 (SQL Injection) signatures through reconnaissance patterns that probe the vulnerable endpoint for parameter manipulation, followed by command injection attempts in the ProjID field. The platform's skills map exploitation chains that establish persistent database access or lateral movement—enabling detection not just of the initial SQL injection, but of downstream attacker objectives like data exfiltration (TA0009) or privilege escalation. Real-world findings would surface suspicious database query patterns, unusual parameter encoding, and anomalous database access from web application service accounts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-124331.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-124331

Casky has 323 skills that investigate the attack patterns behind CVE-2026-124331. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn