CVE Alert: CVE-2025-10090 – Jinher – OA

Risk verdict

High risk: public PoC exploit for remote, unauthenticated SQL injection in Jinher OA GetTreeDate.aspx (versions 1.0–1.2); treat as urgent due to active exploitability.

Why this matters

The vulnerability enables remote data access and potential data tampering without user credentials, which can disrupt administrative workflows and expose sensitive information. Given an exploit is publicly available, attacker automation and mass targeting are likely, increasing the chance of rapid impact across affected deployments.

Most likely attack path

Exploitation requires only network access (AV:N) with low complexity (AC:L) and no privileges (PR:N) or user interaction (UI:N). The attacker can craft the ID parameter to trigger SQL injection via GetTreeDate.aspx, potentially leaking data or impacting the application’s backend. Lateral movement depends on the OA deployment, but initial access is straightforward on exposed servers.

Who is most exposed

Enterprise environments deploying Jinher OA on-premises or in externally accessible cloud/public interfaces are at greatest risk, especially where OA is exposed to the internet or inadequately segmented.

Detection ideas

• Monitor for unusual ID query parameters and SQL error patterns in GetTreeDate.aspx requests.
• Look for unexpected database query strings or repeated failed login-like events from single IPs.
• Detect anomalous data exfiltration indicators in OA-connected databases.
• Inspect web server logs for long-running or failing queries tied to the affected path.
• Correlate alerts with public exploit indicators and CVSS-equivalent exploit activity.

Mitigation and prioritisation

• Apply vendor patch or upgrade to a fixed release as soon as available.
• Implement input validation and parameterised queries on GetTreeDate.aspx; disable or sandbox the endpoint if feasible.
• Deploy web application firewall rules to block suspicious ID inputs and SQLi patterns.
• Enforce network segmentation and restrict OA access to internal networks or VPNs.
• Initiate urgent change-control window for remediation; monitor for PoC indicators and anomalous database activity.