Vulnerability · Published Sep 8, 2025 · Assigned by VulDB
CVE-2025-10090Jinher OA GetTreeDate.aspx sql injection
High 7.3
In plain English
A high-severity SQL injection in OA from Jinher. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)1.9%top 20.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
A flaw has been found in Jinher OA up to 1.2. The impacted element is an unknown function of the file /C6/Jhsoft.Web.departments/GetTreeDate.aspx. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
Affected products (as reported)
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-323045 | Jinher OA GetTreeDate.aspx sql injection vdb-entry, technical-description
- VDB-323045 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #644635 | Jinher OA V1.2 SQL Injection third-party-advisory
- https://github.com/Cstarplus/CVE/issues/1 exploit, issue-tracking