CVE-2024-58352 Details

A vulnerability allowing unauthenticated HQL injection has been identified in Landray OA. This issue arises in the wechatLoginHelper.do endpoint, where attackers can inject malicious HQL syntax into the uid POST parameter. The vulnerability exploits inadequate input sanitization in the filter expression concatenated as a string, which is then passed to the Hibernate findList() method. This exploitation could lead to the unauthorized querying of Hibernate entity classes, allowing attackers to extract sensitive information such as administrator password hashes. Furthermore, with appropriate database privileges, this vulnerability could be leveraged to write files on the server, facilitating remote code execution.

It is recommended to implement proper input validation and sanitization for the uid parameter in the wechatLoginHelper.do endpoint to prevent HQL injection. Additionally, reviewing and patching any affected versions of Landray OA is advised.