Unauthenticated SQL injection in Hongjing Century e-HR exposes database contents

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers can inject UNION-based SQL payloads through the unsanitized codeitemid parameter into the underlying Microsoft SQL Server query to retrieve sensitive database contents including user credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30 (UTC).

• The normalized record marks Hongjing Century e-HR as affected with the custom version value 0.
• VulnCheck states that the affected version range remains undefined.
• No confirmed fixed release or unaffected parallel release branch is identified in the available evidence. A specific build should not be treated as safe solely because no version detail is currently listed.

Hongjing Century e-HR processes requests through the getSdutyTree servlet endpoint. A remote attacker without authentication can place a path traversal sequence in the request URI to bypass the oauthservlet authentication filter and reach the protected endpoint. The codeitemid parameter is not sanitized before it is incorporated into a Microsoft SQL Server query, enabling UNION-based SQL injection. The resulting access can expose sensitive database contents, including user credentials. The available evidence does not establish the exact URI form, query construction, or specific product releases involved.

The vulnerability is remotely reachable by an unauthenticated attacker and does not require user interaction. A path traversal sequence in the request URI is used to bypass the authentication layer, after which the codeitemid parameter can be used for UNION-based SQL injection. The record marks a public exploit, and the DDPOC page advertises a POC download after login but states that no validation environment is currently available. Exploitation evidence was first observed by the Shadowserver Foundation on July 30, 2024 UTC. VulnCheck's advisory page identifies the entry as present in the VulnCheck KEV database, while the supplied record's known_exploited field is null. The available evidence does not name a specific campaign, victim, or ransomware operation.

• The vulnerability permits unauthorized access to protected resources and database contents behind the application.
• Retrieved data may include user credentials, creating risk to e-HR accounts and other systems if those credentials are reused.
• The available evidence focuses on confidentiality and does not confirm data modification, server takeover, or denial of service.
• Operational consequences may include investigation of access scope, assessment of exposed personnel data, and credential changes where evidence supports them. No specific victim or breach is named in the available evidence.

The primary consequence is loss of confidentiality for data stored in the e-HR database, including possible exposure of user credentials. If exposed credentials are reused elsewhere, they could enable additional unauthorized access, but the available evidence does not confirm that outcome. Operators should assess what personnel and account data the e-HR deployment stores and consider credential rotation if investigation shows that such data was accessed. The available evidence describes data retrieval and does not confirm data modification or service disruption.

1. Obtain confirmed affected-branch and fixed-release guidance from Hongjing Century. The available evidence does not provide a confirmed patch or fixed release.
2. Inventory each e-HR instance, build, and deployment branch because the affected range is undefined and the record's 0 value does not provide a useful release boundary.
3. Until vendor guidance is available, restrict direct access from untrusted networks or place the service behind appropriate access controls as a temporary compensating measure. This does not fix the SQL injection and does not guarantee safety.
4. Investigate web and database audit logs for evidence of data retrieval. If credentials appear to have been accessed, rotate the relevant credentials and assess possible reuse.
5. Do not treat a fix or security conclusion for one build as covering other branches without branch-specific confirmation.

1. Inventory all Hongjing Century e-HR deployments, especially instances reachable from untrusted networks, and identify the running build or release.
2. Review web server and application access logs for requests to getSdutyTree, request URIs containing path traversal sequences, or unusual codeitemid values. These are investigation leads, not a complete IOC list.
3. Check the authentication state of requests to the endpoint for anonymous access or requests that appear to have bypassed the oauthservlet authentication filter.
4. If database auditing is available, review unusual reads by the e-HR application account and access to sensitive data or credential-related records.
5. If historical logs are retained, prioritize review around July 30, 2024, when the Shadowserver Foundation first observed exploitation evidence. The absence of matching log entries does not prove that a deployment is safe.