CVE-2023-54399: Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree
Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payload to read arbitrary database content, including credential tables such as operuser. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Any internet-reachable Hongjing e-HR deployment running a version before 8.2 is exposed because the vulnerable endpoint can be reached remotely without authentication.
What does an attacker need to exploit this issue?
An attacker only needs network access to the /servlet/codesettree endpoint. Exploitation uses a crafted UNION SELECT payload in the categories parameter and requires no credentials or user interaction.
What could an attacker access?
A successful attacker can read arbitrary database content through SQL injection, including credential data from tables such as operuser.
Has exploitation been observed?
Yes. The Shadowserver Foundation first observed exploitation evidence on 2023-10-14.