CVE-2023-54399

Summary

This vulnerability allows an unauthenticated attacker to inject SQL queries and read arbitrary database content, including sensitive credential tables.

Exploitability

Exploitation is relatively straightforward as the vulnerability requires no authentication and can be triggered via a crafted URL parameter.

Blast radius

If exploited, the attacker could gain access to sensitive data such as credentials, potentially leading to further attacks or data breaches.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Hongjing e-HR 8.2 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.