A critical, unauthenticated SQL injection flaw in Hongjing e-HR lets remote attackers dump arbitrary database content, including credential tables, through the /servlet/codesettree endpoint.
What Is It
CVE-2023-54399 is a SQL injection vulnerability (CWE-89) in Hongjing e-HR versions before 8.2. The /servlet/codesettree endpoint accepts a categories query parameter that is passed directly into a database query without sanitization after its HRMS-encoding layer is stripped. Because the sanitization gap sits behind that decoding step, input that looks inert on the wire reaches the query engine as raw SQL.
An unauthenticated remote attacker can supply a crafted UNION SELECT payload to read arbitrary database content, including credential tables such as operuser.
Why It Matters
The vulnerability requires no privileges and no user interaction, is reachable over the network, and is low in attack complexity; the combination that puts a flaw at the top of the severity range and makes it viable for untargeted scanning.
Public reporting ties the vulnerability to the exploitation wave documented in CloudSEK's research on Mozi resurfacing as the AndroxGh0st botnet, which would place it in the hands of opportunistic mass-scanning operators rather than targeted actors alone.
Because the target is an HR management platform, a successful read yields employee and operator credential data; material that feeds directly into follow-on account compromise.
What's Vulnerable
- Vendor: Hongjing
- Product: e-HR
- Affected versions: all versions before 8.2
- Entry point:
/servlet/codesettree,categoriesparameter - Access required: none (unauthenticated, remote)
Patch Status
Version 8.2 is the fixed release; the vulnerability affects everything prior. Operators running Hongjing e-HR should upgrade to 8.2 or later. Given the reported botnet exploitation and the credential exposure involved, any internet-exposed instance running a pre-8.2 build should be treated as potentially compromised.
This CVE is not present in the supplied CISA KEV catalog data, so no KEV-mandated remediation deadline applies.