Hongjing e-HR SQL Injection (CVE-2023-54399)

Technical Analysis

CVE-2023-54399 is a SQL injection vulnerability (CVSS 9.8) affecting the /servlet/codesettree endpoint of Hongjing e-HR before version 8.2. The vulnerability stems from improper sanitization of the categories query parameter after HRMS-encoding is stripped, allowing an unauthenticated attacker to inject a crafted UNION SELECT payload into the backend database query. Successful exploitation enables extraction of arbitrary database content, including the operuser table which likely contains hashed or plaintext credentials for administrative and HR system accounts. Given that HR systems often integrate with broader identity and access management infrastructure, compromised credentials could be reused to pivot into adjacent systems. If any AI agent or automation pipeline consumes HR system data via API keys or service accounts stored in this database, exposure of the operuser table could leak credentials that grant agents unauthorized access to downstream systems, representing a plausible but indirect agent-relevant risk.

Affected Systems

Hongjing e-HR versions prior to 8.2, specifically the /servlet/codesettree endpoint and its backend database (including the operuser credential table)

Indicators of Compromise

• Endpoint targeted: /servlet/codesettree?categories=<UNION SELECT payload>
• Exploitation activity first observed: 2023-10-14 (Shadowserver Foundation telemetry)

Remediation Steps

1. 1

   Upgrade Hongjing e-HR

   Update all instances of Hongjing e-HR to version 8.2 or later, which addresses the SQL injection flaw.

2. 2

   Input validation and parameterized queries

   Ensure the application uses parameterized queries or prepared statements for all database interactions, especially on the categories parameter.

3. 3

   Web Application Firewall (WAF) rules

   Deploy WAF signatures to detect and block UNION SELECT and other SQL injection patterns targeting the codesettree endpoint.

4. 4

   Credential rotation

   Rotate all credentials stored in the operuser table and any related systems, assuming potential compromise if the system was internet-facing before patching.

5. 5

   Network exposure reduction

   Restrict access to HR system administrative endpoints to internal networks or VPN-only access, removing unnecessary public internet exposure.

6. 6

   Monitoring and logging

   Enable and review database and web server logs for suspicious UNION SELECT queries or anomalous access to the codesettree endpoint.