CyberRota Analysis
AI-GeneratedJinher OA C6 is vulnerable to an XML External Entity (XXE) injection in the sp_manager_getUserlist.aspx/GetXmlHttp endpoint, allowing unauthenticated remote attackers to exploit this flaw by sending a crafted XML payload. This vulnerability can lead to the unauthorized reading of arbitrary files from the server, posing a significant risk to data confidentiality. Organizations using Jinher OA C6 should prioritize patching this vulnerability to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack.