CVE-2024-58352

Name of the Vulnerable Software and Affected Versions Landray OA (affected versions not specified)

Description An unauthenticated HQL injection exists, allowing attackers to query arbitrary Hibernate entity classes. This occurs due to insufficient input sanitization in the string-concatenated filter expression used in the findList() function. Attackers can inject malicious HQL syntax into the uid parameter of the 'wechatLoginHelper.do' endpoint to extract sensitive data, including administrator password hashes. If the database has sufficient privileges, this can lead to file-write operations and remote code execution. HQL (Hibernate Query Language) is an object-oriented query language used to retrieve data from a database. Evidence of exploitation was first observed on 2024-03-11 (UTC).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the uid parameter in the 'wechatLoginHelper.do' endpoint until the issue is resolved.