CVE-2024-58352 is an unauthenticated Hibernate Query Language (HQL) injection vulnerability in Shenzhen Landray Software Co., Ltd.'s Landray Office Automation (OA) product. The flaw exists due to lack of input sanitization on the uid POST parameter of the wechatLoginHelper.do endpoint, which is concatenated directly into a filter expression passed to Hibernate's findList() method. This allows attackers to execute arbitrary HQL queries, potentially extracting sensitive data such as administrator password hashes. Furthermore, if the database privileges permit, attackers can perform file-write operations that may lead to remote code execution. Exploitation evidence was first noted by Shadowserver Foundation on 2024-03-11. There is no vendor advisory or patch information available at this time.

Successful exploitation allows unauthenticated attackers to execute arbitrary HQL queries against the backend database, leading to unauthorized data disclosure including administrator password hashes. Additionally, with sufficient database privileges, attackers can write files to the server, potentially achieving remote code execution. This represents a high-severity risk due to the combination of unauthenticated access and potential for full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint if possible and monitor for suspicious activity targeting the wechatLoginHelper.do endpoint. Avoid exposing the affected service to untrusted networks. Implement input validation and sanitization on the uid parameter as a temporary mitigation if feasible.