A flaw in Jinher OA C6 allows attackers to manipulate the id/offsnum argument on the OfficeSupplyTypeRight.aspx page, leading to SQL injection. The vulnerability can be triggered remotely, enabling an attacker to read, modify, or delete data within the underlying database, potentially compromising confidentiality, integrity, or availability of sensitive business information. The weakness aligns with CWE-74 URL‑Parameter Manipulation and CWE-89 SQL Injection.

Jinher OA C6 up to the build dated 20260210 is affected. No specific patch level or version list is included beyond this date. The vulnerability resides in the OfficeSupplyTypeRight.aspx endpoint of the Jinher OA C6 application.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% reflects a low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely used exploit has been observed. Attackers would need network or web access to the application and could exploit the flaw remotely by providing crafted requests to the OfficeSupplyTypeRight.aspx endpoint.