CVE-2025-2587

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2587
A vulnerability, which was classified as critical, was found in Jinher OA C6 1.0. This affects an unknown part of the file IncentivePlanFulfillAppprove.aspx. The manipulation of the argument httpOID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://flowus.cn/share/75512a54-e78f-4bfb-80e7-236521b43a02?code=HC3R4E Exploit
https://vuldb.com/?ctiid.300567 Permissions Required
https://vuldb.com/?id.300567 Third Party Advisory
https://vuldb.com/?submit.516025 Third Party Advisory
https://flowus.cn/share/75512a54-e78f-4bfb-80e7-236521b43a02?code=HC3R4E Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:jinher:jinher_oa_c6:1.0:*:*:*:*:*:*:*
History

01 Apr 2025, 20:24

Type Values Removed Values Added
CPE cpe:2.3:a:jinher:jinher_oa_c6:1.0:*:*:*:*:*:*:*
References () https://flowus.cn/share/75512a54-e78f-4bfb-80e7-236521b43a02?code=HC3R4E - () https://flowus.cn/share/75512a54-e78f-4bfb-80e7-236521b43a02?code=HC3R4E - Exploit
References () https://vuldb.com/?ctiid.300567 - () https://vuldb.com/?ctiid.300567 - Permissions Required
References () https://vuldb.com/?id.300567 - () https://vuldb.com/?id.300567 - Third Party Advisory
References () https://vuldb.com/?submit.516025 - () https://vuldb.com/?submit.516025 - Third Party Advisory
First Time Jinher
Jinher jinher Oa C6

21 Mar 2025, 18:15

Type Values Removed Values Added
References () https://flowus.cn/share/75512a54-e78f-4bfb-80e7-236521b43a02?code=HC3R4E - () https://flowus.cn/share/75512a54-e78f-4bfb-80e7-236521b43a02?code=HC3R4E -
Summary
  • (es) Se encontró una vulnerabilidad clasificada como crítica en Jinher OA C6 1.0. Esta afecta a una parte desconocida del archivo IncentivePlanFulfillAppprove.aspx. La manipulación del argumento httpOID provoca una inyección SQL. Es posible iniciar el ataque de forma remota. Se ha hecho público el exploit y puede que sea utilizado.

21 Mar 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-21 12:15

Updated : 2025-04-01 20:24

NVD link : CVE-2025-2587

Mitre link : CVE-2025-2587

CVE.ORG link : CVE-2025-2587

JSON object : View

Products Affected

jinher

  • jinher_oa_c6
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')