CVE-2024-58374

Name of the Vulnerable Software and Affected Versions Hongjing e-HR (affected versions not specified)

Description An unauthenticated SQL injection exists in the 'getSdutyTree' servlet endpoint. Remote attackers can bypass the oauthservlet authentication filter by using a path traversal sequence in the request URI to access protected resources. By providing unsanitized input via the codeitemid parameter, attackers can execute UNION-based SQL payloads against the Microsoft SQL Server database to retrieve sensitive information, such as user credentials. Exploitation of this issue was first observed on 2024-07-30 (UTC).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.