CVE-2024-58374 is an unauthenticated SQL injection vulnerability in Hongjing Century's e-HR product, specifically in the getSdutyTree servlet endpoint. Attackers can bypass the oauthservlet authentication filter by supplying a path traversal sequence in the request URI. They can then inject UNION-based SQL commands through the unsanitized codeitemid parameter, targeting the Microsoft SQL Server backend. This allows retrieval of sensitive data such as user credentials. The vulnerability was publicly disclosed with a CVSS 4.0 score of 8.7 (high severity) and exploitation evidence was first noted by Shadowserver Foundation on 2024-07-30. No vendor patch or mitigation details are available at this time.

Successful exploitation enables remote unauthenticated attackers to bypass authentication controls and execute arbitrary SQL queries on the backend database. This can lead to unauthorized disclosure of sensitive information, including user credentials, potentially compromising the confidentiality and integrity of the system and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint, implement web application firewall (WAF) rules to detect and block SQL injection attempts, and monitor for suspicious activity targeting the getSdutyTree servlet. Avoid exposing the affected endpoint to untrusted networks if possible.