CVE-2024-58352

Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input sanitization in the string-concatenated filter expression passed to the Hibernate findList() call to extract sensitive data such as administrator password hashes and, with sufficient database privileges, perform file-write operations enabling remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-11 (UTC).

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://blog.csdn.net/fushuang333/article/details/136377020
https://blog.csdn.net/qq_39342001/article/details/137354047
https://cn-sec.com/archives/2532828.html
https://www.vulncheck.com/advisories/landray-oa-unauthenticated-hql-injection-via-wechatloginhelper-do

Configurations

No configuration.

History

02 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Landray OA contiene una vulnerabilidad de inyección HQL no autenticada que permite a atacantes no autenticados consultar clases de entidad Hibernate arbitrarias inyectando sintaxis HQL maliciosa en el parámetro POST uid del endpoint wechatLoginHelper.do. Los atacantes pueden explotar la falta de saneamiento de entrada en la expresión de filtro concatenada por cadena pasada a la llamada Hibernate findList() para extraer datos sensibles como hashes de contraseñas de administrador y, con suficientes privilegios de base de datos, realizar operaciones de escritura de archivos lo que permite la ejecución remota de código. Evidencia de explotación fue observada por primera vez por la Shadowserver Foundation el 2024-03-11 (UTC).

Information

Published : 2026-07-02 17:16

Updated : 2026-10-02 00:10

NVD link : CVE-2024-58352

Mitre link : CVE-2024-58352

CVE.ORG link : CVE-2024-58352

JSON object : View

Products Affected

No product.

CWE

CWE-564

SQL Injection: Hibernate

{"id": "CVE-2024-58352", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58352", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-02T17:49:16.594140Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Shenzhen Landray Software Co., Ltd.", "product": "Landry Office Automation (OA)", "versions": [{"status": "affected", "version": "*", "versionType": "custom"}], "defaultStatus": "affected"}]}], "published": "2026-07-02T17:16:57.557", "references": [{"url": "https://blog.csdn.net/fushuang333/article/details/136377020", "source": "disclosure@vulncheck.com"}, {"url": "https://blog.csdn.net/qq_39342001/article/details/137354047", "source": "disclosure@vulncheck.com"}, {"url": "https://cn-sec.com/archives/2532828.html", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/landray-oa-unauthenticated-hql-injection-via-wechatloginhelper-do", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-564"}]}], "descriptions": [{"lang": "en", "value": "Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input sanitization in the string-concatenated filter expression passed to the Hibernate findList() call to extract sensitive data such as administrator password hashes and, with sufficient database privileges, perform file-write operations enabling remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-11 (UTC)."}, {"lang": "es", "value": "Landray OA contiene una vulnerabilidad de inyecci\u00f3n HQL no autenticada que permite a atacantes no autenticados consultar clases de entidad Hibernate arbitrarias inyectando sintaxis HQL maliciosa en el par\u00e1metro POST uid del endpoint wechatLoginHelper.do. Los atacantes pueden explotar la falta de saneamiento de entrada en la expresi\u00f3n de filtro concatenada por cadena pasada a la llamada Hibernate findList() para extraer datos sensibles como hashes de contrase\u00f1as de administrador y, con suficientes privilegios de base de datos, realizar operaciones de escritura de archivos lo que permite la ejecuci\u00f3n remota de c\u00f3digo. Evidencia de explotaci\u00f3n fue observada por primera vez por la Shadowserver Foundation el 2024-03-11 (UTC)."}], "lastModified": "2026-10-02T00:10:00.180", "sourceIdentifier": "disclosure@vulncheck.com"}