CVE-2024-58374General

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers can inject UNION-based SQL payloads through the unsanitized codeitemid parameter into the underlying Microsoft SQL Server query to retrieve sensitive database contents including user credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30 (UTC).

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
General: 2 classified signals
Disclosure: 1 classified signal
Peaked 1d ago at 2 mentions (2026-08-13); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

General

266.7%

Disclosure

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-13	2	Disclosure1General1
2026-08-14	1	General1

Full discourse3 posts

Vulmon Vulnerability Feed@VulmonFeeds46d
General
CVE-2024-58374 Unauthenticated SQL Injection and Path Traversal in Hongjing e-HR https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-58374 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post announces CVE-2024-58374, noting it involves unauthenticated SQL injection and path traversal in Hongjing e‑HR, and provides a link to additional details, but offers no PoC, exploit code, or information on patches or active exploitation.
00000103
4.1K followersView on X
Infoflowcloud@infoflowcloud46d
General
🚨*CVE* CVE-2024-58374 Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access prot… https://www.cve.org/CVERecord?id=CVE-2024-58374 ----- Traducción: CVE-2024-58374 Hon… https://infoflow.cloud`
Post summary
The tweet reports the existence of an unauthenticated SQL injection flaw in Hongjing e‑HR’s getSdutyTree endpoint but lacks details on PoC, exploitation, or remediation.
0000024
97 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2024-58374 Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access prot… https://www.cve.org/CVERecord?id=CVE-2024-58374
Post summary
The text reports a newly disclosed unauthenticated SQL injection vulnerability (CVE‑2024‑58374) in Hongjing e‑HR, without providing a PoC, exploit code, patch, or evidence of active exploitation.
000001.1K
57.9K followersView on X

Explore more

Back to dashboard