CVE-2024-58374 is a high severity (CVSS 7.5) SQL injection in Hongjing e-HR. An unauthenticated request can bypass the oauthservlet authentication filter and reach the getSdutyTree servlet, where the codeitemid parameter is injectable. The record names no fixed version, so ask the vendor and block outside access.
What's affected
The NVD record names the product as Hongjing e-HR, a human resources system, and gives no version range. The vulnerable endpoint is the getSdutyTree servlet and the injectable input is the codeitemid parameter, which reaches a Microsoft SQL Server query.
Two weaknesses are combined. First, a path traversal sequence in the request address lets a request slip past the authentication filter in front of the servlet. Second, the parameter is not sanitized before use in the query. The record says the result is access to sensitive database contents, including user credentials.
The record also states that exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30 (UTC). That is the record's own statement. The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Because the record has no version or product CPE data, the check is about your own deployment.
- Confirm whether your organization runs Hongjing e-HR and who hosts it.
- Ask the vendor or your integrator which release you run and whether the servlet is patched.
- Search web logs for requests to
getSdutyTree, particularly ones with long or oddcodeitemidvalues, or with unusual path segments before the servlet name. - Check whether the HR system is reachable from the internet. If it is, plan to change that.
HR systems hold personal data, so if any suspicious request reached the servlet, involve your privacy and incident response contacts early.
What to do now
- Confirm whether Hongjing e-HR is in use and where it is exposed.
- Remove direct internet exposure and require VPN or an allowlist for access.
- Ask the vendor for a patched release and apply it once confirmed.
- Review web logs for requests to the getSdutyTree servlet and for path tricks before the authentication filter.
- Rotate any credentials stored in the HR database and review accounts.
- Add a web application firewall rule for the servlet while you wait for a fix.
Why it matters
This record shows two common mistakes side by side. The authentication filter matched on the request path in a way that a crafted path could avoid, and the servlet behind it trusted its inputs.
A filter that decides by string matching on the URL is fragile, because web servers and application containers normalize paths in different ways. The safer pattern is to enforce authentication inside the handler or through a framework that works on the normalized route. On the data side, parameterized queries remove the injection regardless of who reaches the code.
The weakness class is CWE-89: SQL Injection. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, which scores 7.5. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Is this being exploited?
The record says the Shadowserver Foundation first saw exploitation evidence on 2024-07-30. It is not in the CISA KEV catalog.
Is there a fixed version?
The sources we checked do not name one. Ask the vendor.
Sources
Last reviewed: 19 October 2026.
