Jinher OA C6 SQL Injection Vulnerability in IncentivePlanFulfillAppprove.aspx

A critical SQL injection vulnerability has been identified in Jinher OA C6 version 1.0. The issue arises in the file IncentivePlanFulfillAppprove.aspx, where the httpOID argument can be manipulated to execute SQL injection attacks. This vulnerability can be exploited remotely, and details of the exploit have been made public.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

The vulnerability can be reproduced by sending a request to the IncentivePlanFulfillAppprove.aspx file with a crafted httpOID argument that exploits the application's SQL query handling. This can be done remotely.