A critical unauthenticated SQL injection vulnerability, tracked as CVE-2024-58374, affecting Hongjing e-HR software, was exploited on the same day it was publicly disclosed. The vulnerability, which has a CVSS score of 7.5 (high severity), allows remote attackers to access sensitive database contents, including user credentials, without authentication.
The flaw resides in the `getSdutyTree` servlet endpoint. Attackers can bypass the `oauthservlet` authentication filter by providing a path traversal sequence in the request URI. Once authentication is bypassed, they can inject UNION-based SQL payloads into the unsanitized `codeitemid` parameter, targeting the underlying Microsoft SQL Server database to extract confidential information.
CVE-2024-58374 was published on August 13, 2026, and was listed in a commercial exploit catalog on the same day. While the US federal CISA KEV and EUVD (ENISA) catalogs do not list this CVE, VulnCheck's KEV catalog included it on August 13, 2026, with CIRCL, an aggregator, mirroring this listing on August 28, 2026.
Evidence of public exploitation was first observed by the Shadowserver Foundation on July 30, 2024 (UTC), preceding the CVE's official publication. Subsequent reports of exploitation were noted on August 13, 2026, and August 28, 2026, by Shadowserver, with the latest sighting recorded on September 2, 2026.
The vulnerability's EPSS (Exploit Prediction Scoring System) score is 0.47%, placing it in the 39.4th percentile, indicating a moderate likelihood of exploitation. The weakness is categorized under CWE-89, which refers to improper neutralization of special elements used in an SQL command ('SQL Injection').
