CVE-2023-54399

CriticalCVSS 9.8

Published: 18/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Summary

Hongjing e-HR before 8.2 has a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories parameter is passed without sanitization. An unauthenticated remote attacker can use UNION SELECT to read arbitrary database content, including credential tables.

Risk Assessment

An attacker can access sensitive data, including user credentials, potentially leading to compromise of the entire HR system.

Recommendation

Upgrade Hongjing e-HR to version 8.2 or later. Additionally, apply input filtering and use parameterized queries.

Other vulnerabilities in Hongjing e-HR

CVE-2024-58374High
Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers can inject UNION-based SQL payloads through the unsanitized codeitemid parameter into the underlying Microsoft SQL Server query to retrieve sensitive database contents including user credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30 (UTC).

Original NVD description (English source)

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payload to read arbitrary database content, including credential tables such as operuser. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.