SQL Injection in Hongjing e-HR /servlet/codesettree

Hongjing e-HR versions prior to 8.2 contain a critical SQL injection vulnerability residing in the /servlet/codesettree endpoint. The application fails to properly sanitize the 'categories' query parameter after stripping HRMS-specific encoding, allowing an unauthenticated remote attacker to inject malicious SQL syntax. This vulnerability permits the execution of UNION SELECT statements, which can be leveraged to query arbitrary tables within the backend database. Defenders should note that this flaw can be exploited to exfiltrate sensitive data, including administrative credentials from the operuser table. This vulnerability has been subject to active exploitation in the wild since October 2023, as identified by the Shadowserver Foundation.

Impact

Successful exploitation allows unauthenticated attackers to gain unauthorized access to sensitive corporate data. By targeting credential tables such as operuser, attackers can obtain account information, facilitating further unauthorized access to the HR management system and potentially lateral movement within the network. This affects organizations utilizing Hongjing e-HR globally.

Recommendation

1. Upgrade all instances of Hongjing e-HR to version 8.2 or higher immediately to address the underlying vulnerability.
2. Implement strict input validation on the /servlet/codesettree endpoint to reject requests containing SQL keywords or metacharacters in the categories parameter.
3. Monitor web access logs for suspicious HTTP requests targeting /servlet/codesettree containing UNION, SELECT, or character manipulation strings.
4. Perform a security audit of the backend database to check for unauthorized access or dumped credential records following the timeline of observed exploitation (since October 2023).