CVE-2023-54399

CVE-2023-54399 affects Hongjing e-HR versions before 8.2 , where the categories query parameter in the /servlet/codesettree endpoint is passed to a database query without sanitization after HRMS-encoding is stripped. This allows an unauthenticated remote attacker to use a crafted UNION SELECT pay...