Description

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers can inject UNION-based SQL payloads through the unsanitized codeitemid parameter into the underlying Microsoft SQL Server query to retrieve sensitive database contents including user credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30 (UTC).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T18:17:16.433Z",
  "pubdate": "2026-08-13T18:17:16.433Z",
  "executiveSummary": "Hongjing e-HR contains an unauthenticated SQL injection vulnerability located within the getSdutyTree servlet endpoint. This flaw allows remote, unauthenticated attackers to bypass security controls and interact directly with the underlying Microsoft SQL Server database.\nThe vulnerability enables malicious actors to leverage a path traversal sequence within the request URI, effectively bypassing the oauthservlet authentication filter designed to protect sensitive application resources.\nOnce the authentication boundary is bypassed, attackers can supply UNION-based SQL payloads through the unsanitized codeitemid parameter. This input is processed directly by the database query logic without adequate sanitization or parameterization.\nThe resulting impact includes unauthorized data exfiltration, specifically the retrieval of sensitive database contents such as user credentials, posing a critical risk to overall system confidentiality and integrity.\nExploitation of this vulnerability requires network access to the exposed Hongjing e-HR instance and has been observed in active threat campaigns, as documented by the Shadowserver Foundation on 2024-07-30 (UTC).",
  "technicalDetails": "The root cause of this security defect stems from two primary architectural flaws: improper input validation and flawed request filtering in the authentication mechanism.\nThe vulnerable component is the getSdutyTree servlet endpoint, which interacts directly with an underlying Microsoft SQL Server instance.\nNetwork exposure is remote, as the endpoint is accessible over the network to unauthenticated users. Authentication and privilege requirements are entirely bypassed during the initial attack phase.\nAttack flow begins when a remote unauthenticated attacker crafts a specialized HTTP request targeting the getSdutyTree servlet endpoint. The attacker incorporates a path traversal sequence into the request URI. This sequence tricks the oauthservlet authentication filter into misinterpreting the request path, allowing the attacker to bypass access control checks intended to restrict unauthenticated traffic.\nFollowing the authentication bypass, the attacker targets the unsanitized codeitemid parameter. This parameter accepts user-supplied input that is subsequently concatenated or improperly handled within the construction of a database query destined for the Microsoft SQL Server backend.\nThe payload behavior utilizes UNION-based SQL injection techniques. By appending crafted SQL statements using UNION operators to the codeitemid parameter, the attacker forces the database to append the results of the injected query to the application's legitimate response.\nPost-exploitation impact involves the unauthorized extraction of sensitive database contents. Attackers can successfully dump database tables, harvest user credentials, and potentially gain deeper administrative access to the underlying system depending on database permissions and configuration."
}