The vulnerability allows an attacker to craft an HTTP request that sets the httpOID parameter to an arbitrary value, injecting SQL code into the backend query. This can lead to the execution of arbitrary SQL statements, enabling unauthorized data disclosure, modification, or deletion. The weakness is a classic injection flaw (CWE-74 and CWE-89) that targets web input handling and database interaction.

The affected software is Jinher OA, specifically version 1.0 as identified in the advisory, though the issue may apply to other releases that share the same vulnerable code in nextselectplan.aspx.

The CVSS score of 6.9 indicates a moderate severity overall. No EPSS data is available, but the vulnerability is publicly disclosed and can be triggered remotely without authentication, meaning an attacker could exploit it from the Internet. The lack of a KEV listing suggests no evidence of widespread exploitation yet, yet the potential for data compromise remains significant.