A SQL injection flaw exists in the jinher OA 1.0 component through the /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx endpoint. The vulnerable httpOID argument can be manipulated to inject arbitrary SQL commands, potentially allowing an attacker to read, modify, or delete data in the underlying database. This weakness directly threatens the confidentiality and integrity of organizational data and could be leveraged for further attacks if attackers gain sufficient access to the database.

The vulnerability is present in Jinher OA 1.0, specifically in the attendance_out_approve.aspx module. No specific sub‑versions or build numbers are listed, but any deployment that includes the identified file and parameter is affected.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers can execute the injection remotely via an HTTP request to the httpOID parameter, as the vulnerability does not require local or privileged access. Because the exploitation code has been publicly disclosed, the likelihood of exploitation is higher in environments that have not yet applied a fix or mitigated the input handling.