CVE-2023-54399

Hongjing e-HR before 8.2 is affected by a SQL injection in the /servlet/codesettree endpoint. The categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped, allowing an unauthenticated remote attacker to supply a crafted UNION SELECT payload and...