CVE-2024-58352 Landray OA Unauthenticated HQL Injection via wechatLoginHelper.do
Unauthenticated attackers can inject HQL to extract sensitive data and potentially execute code via file-write operations in Landray OA.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-58352?
CVE-2024-58352 is a high-severity SQL injection vulnerability in Shenzhen Landray Software Co., Ltd. Landry Office Automation (OA), published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input sanitization in the string-concatenated filter expression passed to the Hibernate findList() call to extract sensitive data such as administrator password hashes and, with sufficient database privileges, perform file-write operations enabling remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-11 (UTC).
Weakness: CWE-564
Which versions are affected by CVE-2024-58352?
How do I fix CVE-2024-58352?
No fix has been published for CVE-2024-58352 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-58352 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-58352 exists.
Sources
Also known as GHSA-xghx-f376-x86r.