A SQL injection flaw exists in the Jinher OA C6 application, specifically in the ProjectAfficheManage.aspx page. Manipulating the ProjID query argument allows an attacker to embed arbitrary SQL code. This input validation weakness (CWE‑74 and CWE‑89) can lead to unauthorized data disclosure, data modification, or even remote code execution if the underlying database is compromised. The vendor has not issued a fix; the vulnerability is publicly documented and exploitable over the network.

The flaw affects the Jinher OA product, version C6. Exact patch levels are unknown, but any installation that exposes the ProjectAfficheManage.aspx endpoint with the ProjID parameter is vulnerable.

The CVSS score of 6.9 indicates a moderate‑to‑high risk, and the lack of an EPSS rating reflects insufficient data on exploitation likelihood. Because the vulnerability is enabled by a standard HTTP request and an exploit exists online, an attacker can target any exposed instance. The issue is not listed in CISA KEV, yet its remote nature and moderate severity warrant prompt attention. The attack vector is inferred to be an HTTP request with a crafted ProjID value.