CVE-2023-54399: Hongjing e-HR SQL Injection Vulnerability

CVE-2023-54399 Overview

CVE-2023-54399 is an unauthenticated SQL injection vulnerability [CWE-89] in Hongjing e-HR versions before 8.2. The flaw resides in the /servlet/codesettree endpoint, where the categories query parameter is concatenated into a database query after HRMS-encoding is stripped. No sanitization is applied to the decoded value. A remote attacker can supply a crafted UNION SELECT payload to read arbitrary database contents, including the operuser credential table. The Shadowserver Foundation first observed exploitation attempts on 2023-10-14.

Critical Impact
Unauthenticated remote attackers can exfiltrate credentials and arbitrary database records from vulnerable Hongjing e-HR deployments, enabling downstream account takeover and lateral movement.

Affected Products

Hongjing e-HR versions prior to 8.2
Deployments exposing the /servlet/codesettree endpoint to untrusted networks
HRMS instances processing categories query parameter input without validation

Discovery Timeline

2023-10-14 - Exploitation activity first observed by the Shadowserver Foundation
2026-09-18 - CVE-2023-54399 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2023-54399

Vulnerability Analysis

The vulnerability is a classic SQL injection in a legacy Java servlet that handles code-set tree lookups for the Hongjing e-HR platform. When a request reaches /servlet/codesettree, the servlet reads the categories query parameter and applies a proprietary HRMS decoding routine to it. The decoded value is then concatenated directly into a SQL statement without parameterization or type validation.

Because authentication is not required to reach the endpoint, any network-adjacent attacker can send crafted requests. Public write-ups and the VulnCheck advisory document successful UNION SELECT extraction of the operuser table, which stores operator credentials. Attackers have chained this access with credential reuse to pivot into administrative interfaces.

Root Cause

The root cause is insufficient input neutralization of the categories parameter. The HRMS decoding step transforms attacker-controlled input into raw SQL fragments, and the resulting string is passed to a JDBC Statement execution path rather than a PreparedStatement. This design allows syntactic control of the query.

Attack Vector

Exploitation requires a single HTTP GET request to /servlet/codesettree with a maliciously crafted categories parameter. The attacker encodes a UNION SELECT payload using the HRMS encoding scheme, submits it over the network, and parses the HTTP response for extracted rows. No credentials, user interaction, or prior foothold are required. Detailed technical write-ups are available in the VulnCheck SQL Injection Advisory and the CNVD Security Flaw CNVD-2023-08743 record.

Detection Methods for CVE-2023-54399

Indicators of Compromise

HTTP requests to /servlet/codesettree containing categories= parameter values with SQL keywords such as UNION, SELECT, FROM, or operuser
Anomalous response sizes or elevated 500-series errors from the codesettree servlet
Outbound scanning traffic from HR application servers following suspicious inbound requests, consistent with the Mozi/AndroxGh0st activity documented in the CloudSEK Blog Post on Mozi Botnet
Unexpected reads against the operuser table in database audit logs

Detection Strategies

Deploy web application firewall signatures that flag SQL metacharacters and UNION SELECT patterns in the categories parameter of codesettree requests
Correlate application access logs with database query logs to surface unauthenticated reads of credential tables
Hunt for known exploitation user agents and payload structures documented in the CN-Sec Archive Article and the CNBlogs Security Analysis

Monitoring Recommendations

Enable verbose access logging on all Hongjing e-HR web front-ends and forward logs to a central analytics platform
Alert on any GET or POST request to /servlet/codesettree from external source ranges
Monitor the operuser table and other credential stores for unusual read volumes or off-hours access

How to Mitigate CVE-2023-54399

Immediate Actions Required

Upgrade Hongjing e-HR to version 8.2 or later, which addresses the SQL injection in the codesettree servlet
Restrict network access to /servlet/codesettree using an upstream reverse proxy or firewall until patching is complete
Rotate all operator credentials stored in the operuser table, since prior exposure must be assumed for internet-facing systems
Review database and application logs from 2023-10-14 onward for evidence of exploitation

Patch Information

Hongjing has addressed the flaw in e-HR version 8.2. Administrators should consult vendor release notes and the VulnCheck SQL Injection Advisory for upgrade guidance. Systems that cannot be immediately upgraded should apply the workarounds below and treat the deployment as compromised until forensic review is complete.

Workarounds

Block requests containing SQL metacharacters in the categories parameter at the WAF layer
Deny external access to /servlet/codesettree and require VPN or bastion connectivity for administrative usage
Apply database-layer least privilege so that the application account cannot read sensitive tables outside its functional scope
Enable database query logging and set alerts on UNION-based reads targeting credential tables

bash

# Example nginx rule to block SQL injection attempts against the vulnerable endpoint
location /servlet/codesettree {
    if ($args ~* "(union|select|from|operuser|--|;)") {
        return 403;
    }
    proxy_pass http://ehr_backend;
}