CVE-2024-58374 in e-HR
Summary
by MITRE • 08/13/2026
Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers can inject UNION-based SQL payloads through the unsanitized codeitemid parameter into the underlying Microsoft SQL Server query to retrieve sensitive database contents including user credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30 (UTC).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The Hongjing e-HR system presents a critical security vulnerability through an unauthenticated sql injection flaw in its getSdutyTree servlet endpoint that fundamentally undermines the application's authentication and authorization mechanisms. This vulnerability exists within the oauthservlet authentication filter which fails to properly validate incoming requests, allowing malicious actors to bypass security controls by crafting specific path traversal sequences in the request URI. The flaw manifests when the codeitemid parameter is processed without adequate sanitization, creating an entry point for attackers to manipulate database queries directly.
The technical exploitation of this vulnerability follows a well-established pattern where attackers leverage union-based sql injection techniques to extract sensitive data from the underlying microsoft sql server backend. The unsanitized codeitemid parameter becomes the primary vector through which malicious payloads are injected into database queries, enabling unauthorized access to protected resources that should only be available to authenticated users. This vulnerability directly maps to common weakness enumeration cwe-89 which categorizes improper neutralization of special elements used in sql commands as a critical security flaw.
Operational impact of this vulnerability extends far beyond simple data exposure, as it provides attackers with the capability to extract user credentials and other sensitive database contents that could be used for further compromise within the organization's network infrastructure. The authentication bypass mechanism means that even systems requiring user validation can be accessed by unauthorized parties, potentially leading to complete system takeover scenarios. Security researchers first documented exploitation attempts on 2024-07-30 utc, indicating this vulnerability has been actively targeted in the wild, suggesting it represents a significant risk to organizations using the affected system.
The implications of this vulnerability align with attack technique t1190 from the mitre att&ck framework which describes exploiting vulnerabilities in applications to gain access to systems. Organizations utilizing Hongjing e-HR should immediately implement comprehensive mitigations including parameterized queries, input validation, and enhanced authentication controls to prevent exploitation. Additionally, network segmentation and monitoring solutions should be deployed to detect anomalous traffic patterns that may indicate attempted exploitation of this vulnerability. The presence of such an unauthenticated sql injection flaw in a human resources system particularly concerning as it could provide attackers with access to sensitive employee information including personal identification numbers, payroll data, and other confidential personnel records.