Weini123

**Name of the Vulnerable Software and Affected Versions** Jinher OA version 1.0 **Description** A SQL injection flaw exists in the `/C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx` endpoint. The issue occurs when the `httpOID` argument is manipulated, allowing for remote exploitation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `httpOID` parameter in the `/C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx` endpoint until the issue is resolved.