SQL Injection Vulnerability in Jinher OA 1.0

A SQL injection vulnerability has been identified in Jinher OA version 1.0, specifically within the '/C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx' file. The vulnerability is triggered by the improper neutralization of the 'httpOID' argument, which is directly processed by the application's backend database. This flaw enables unauthenticated remote attackers to inject malicious SQL commands, potentially leading to unauthorized data access, modification, or full compromise of the database backend. Publicly available exploit code has been released for this vulnerability, and the vendor has not provided a patch or a response to the disclosure. Defenders should prioritize auditing web server logs for requests targeting this specific ASPX endpoint containing non-standard or SQL-like syntax within the query parameters.

Attack Chain

1. Attacker performs reconnaissance to identify the presence of Jinher OA 1.0 web applications.
2. Attacker crafts an HTTP GET or POST request targeting the 'attendance_out_approve.aspx' endpoint.
3. Attacker injects malicious SQL payloads into the 'httpOID' parameter to test for injection vulnerability.
4. The web application's backend server processes the unsanitized input within a database query.
5. The database executes the injected commands, granting the attacker access to or control over data.
6. Attacker exfiltrates sensitive information or escalates privileges within the database environment.

Impact

Successful exploitation of this vulnerability allows unauthenticated remote attackers to gain unauthorized access to the application's underlying database. This could result in the exfiltration of sensitive organizational data, manipulation of attendance records, or potential further compromise of the web server if the database service account has excessive permissions. Given the public availability of exploit code, the risk of automated scanning and exploitation is high.

Recommendation

• Deploy the provided Sigma rule to web server access logs to detect potential exploitation attempts targeting the identified endpoint.
• Monitor inbound web traffic for high-frequency or anomalous requests to '/C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx'.
• Implement input validation at the web application firewall (WAF) layer to block common SQL injection patterns in the 'httpOID' parameter.
• Restrict network access to the Jinher OA application, exposing it only to necessary internal network segments until the vendor provides a patch.