A Hidden Backdoor in Popular Office Software Could Hand Hackers Your Entire Company Database

Imagine walking into work one morning to find every employee record, every internal memo, every client contract — gone, or worse, in someone else's hands. That's the reality facing organizations running Jinher OA 1.0 right now.

Who's at Risk — and Why It Matters

Jinher OA is an office automation and collaboration platform widely used by businesses, government offices, and institutions — particularly across Chinese-speaking markets — to manage internal workflows, personnel records, project planning, and corporate communications. "OA" software is the digital nervous system of an organization: calendars, approvals, HR records, and sensitive documents all flow through it.

CVE-2026-7670, rated HIGH with a CVSS score of 7.3, means any organization running Jinher OA 1.0 is potentially sitting on an unlocked vault. The attacker doesn't need to be an insider. They don't need a password. They just need a network connection and knowledge of this flaw — knowledge that is now publicly available, because a working exploit has already been published online.

Plain English: What an Attacker Can Actually Do

Think of your company's database as a locked filing room. The software — Jinher OA — is the receptionist who decides who gets in and what they can see. Normally, when you ask the receptionist for a specific department's files, they verify who you are, then fetch only what you're allowed to see.

This vulnerability breaks that process entirely. There's a specific web page inside Jinher OA designed to let authorized users select staff by department. When it processes your request, it passes your input — the department ID you typed — almost directly into the database query with no safety checks. An attacker can manipulate that input to slip in their own secret instructions alongside the legitimate request. Instead of asking for "Department 5's records," they can quietly add commands like "…and also give me every username and password in the system," or "delete everything," or even "run this program for me." The receptionist never catches it, because the forgery is hidden inside a legitimate-looking request.

Because this page is accessible over the internet — no special network access required — an attacker sitting anywhere in the world can attempt this. They could silently copy your entire database, tamper with records to cover their tracks, lock you out of your own systems, or use the compromised server as a launchpad to attack other parts of your network. And because the exploit code is already public, the technical barrier to carrying this out is extremely low. This is no longer a vulnerability only elite hackers can exploit.

The Technical Anchor: What's Actually Broken

For security professionals: the vulnerability is a classic unsanitized SQL injection affecting the DeptIDList parameter in the file /C6/JHSoft.Web.PlanSummarize/UserSel.aspx. The parameter value is concatenated directly into a backend SQL query without parameterized queries or input validation, enabling both UNION-based and error-based injection attack vectors. Given the tags associated with this CVE — including remote code execution — the database user account running the queries may carry elevated OS-level permissions, making RCE a realistic downstream risk depending on the server configuration. CVSS 7.3 (HIGH), cross-platform.

How This Came to Light — and What We Know So Far

This vulnerability was responsibly disclosed to Jinher before going public. The vendor was contacted early in the process — and never responded. Not a patch, not an acknowledgment, not a timeline. Nothing. That silence left researchers with no choice but to publish, following standard responsible disclosure practices, in hopes that public pressure would force action and that administrators would at least be warned.

As of now, no active exploitation in the wild has been confirmed. There are no known ransomware campaigns or data theft incidents officially linked to this CVE at this time. However, the combination of a publicly available exploit, a high-severity score, and vendor silence is a recipe for rapid weaponization. History is full of examples — from Log4Shell to MOVEit — where the gap between "exploit published" and "mass exploitation begins" was measured in hours, not weeks.

Security teams should treat this as a fire drill starting today, not something to schedule for next quarter's patch cycle.

What to Do Right Now: 3 Steps

1. Confirm your version immediately. Log into your Jinher OA installation and verify whether you are running version 1.0. Navigate to the system administration or "About" panel. If you are on version 1.0 and the UserSel.aspx page is reachable from the internet, treat your system as compromised until proven otherwise. Audit your database access logs for unusual queries containing UNION, SELECT, or comment characters (--, /*) going back at least 30 days.
2. Block external access to the vulnerable endpoint now. At your firewall or web application firewall (WAF), immediately restrict access to /C6/JHSoft.Web.PlanSummarize/UserSel.aspx to internal IP ranges only. If your WAF supports SQL injection rule sets (such as OWASP ModSecurity Core Rule Set 3.3+), enable them and set them to blocking mode for this path. This is a stopgap — not a fix — but it closes the most dangerous attack surface while you work on a longer-term solution.
3. Demand a patch — and prepare to migrate if none comes. Contact Jinher support directly and in writing, citing CVE-2026-7670, and request an official patched release with a firm delivery date. Given that the vendor ignored the original researcher's disclosure, document all communication. If no patch is issued within your organization's acceptable risk window (typically 30 days for a HIGH-severity, publicly exploited vulnerability), begin evaluating alternative OA platforms. In the meantime, consider taking the Jinher OA instance fully offline or moving it behind a VPN requiring multi-factor authentication.

Editor's note: This article is based on publicly disclosed vulnerability information. No vendor patch was available at time of publication. Organizations affected should consult their security teams and legal counsel regarding incident response obligations.