SQL Injection in Jinher OA User Selection Parameter

A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/UserSel.aspx. This manipulation of the argument DeptIDList causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Jinher OA 1.0 contains a critical SQL injection vulnerability in the UserSel.aspx file's DeptIDList parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands against the backend database. This vulnerability is particularly concerning because Jinher OA is an enterprise office automation platform likely deployed across organizations for document management, workflow processing, and employee administration. The vulnerability affects any organization running the vulnerable version, with no vendor support available—organizations must either upgrade or implement compensating controls immediately.

Casky's 301 matching skills, powered by Claude AI's extended reasoning, would detect this attack pattern by correlating MITRE techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance) with indicators of SQL injection exploitation. Practitioners would observe in their findings: suspicious parameter manipulation in HTTP requests to /C6/JHSoft.Web.PlanSummarize/UserSel.aspx, SQL syntax patterns in DeptIDList values, unusual database query execution, and anomalous data exfiltration patterns. The skills would flag CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection) signatures, enabling practitioners to identify both active exploitation attempts and lateral movement using compromised database access. With CVSS 7.3 severity and public exploit availability, these detection patterns should be prioritized in threat hunting and incident response workflows.

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-7670.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-7670 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn