SEC.co
Emergency
HIGH 7.5

CVE-2024-58352: Unauthenticated HQL Injection in Landray OA – Critical Data Breach Risk

Landray OA, a collaboration and office automation platform, contains a critical flaw that allows attackers to bypass authentication entirely and extract sensitive information directly from the database. The vulnerability exists in the login helper functionality, where user input is not properly validated before being used to construct database queries. An attacker can craft a specially-formatted request to retrieve administrator credentials, database records, or—in certain configurations—write arbitrary files to the server, leading to complete system compromise. This is a post-authentication-bypass, pre-RCE chain that significantly expands the attack surface.

Source data · NVD / CISA · public domain

CVSS
3.1 · 7.5 HIGH · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses (CWE)
CWE-564
Affected products
0 configuration(s)
Published / Modified
2026-07-02 / 2026-07-02

NVD description (verbatim)

Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input sanitization in the string-concatenated filter expression passed to the Hibernate findList() call to extract sensitive data such as administrator password hashes and, with sufficient database privileges, perform file-write operations enabling remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-11 (UTC).

4 reference(s) · View on NVD →

SEC.co analysis · AI-assisted, reviewed against source

Technical summary

CVE-2024-58352 is an unauthenticated HQL (Hibernate Query Language) injection vulnerability in the wechatLoginHelper.do endpoint of Landray OA. The vulnerability stems from unsafe string concatenation of user-supplied input from the 'uid' POST parameter directly into a Hibernate findList() filter expression, without sanitization or parameterized query protection. Attackers inject malicious HQL syntax to traverse arbitrary entity classes, circumvent intended query constraints, and retrieve or modify data within the application's Hibernate ORM context. The attack chain permits extraction of sensitive object properties (including password hashes) and, depending on database configuration and privileges, execution of database-level file operations. The Shadowserver Foundation documented active exploitation as of March 11, 2024.

Business impact

Successful exploitation enables complete compromise of administrator accounts, exposure of all user records, and potential lateral movement to backend systems. Organizations relying on Landray OA for sensitive internal communications, document management, or identity federation face immediate credential theft risk. The unauthenticated nature means no valid user account is required—any Internet-accessible instance is exploitable. RCE capability (via file-write operations on permissive database configurations) elevates this to a worm-capable threat. Customer trust, regulatory compliance (GDPR, CCPA), and operational continuity are at stake.

Affected systems

Landray OA installations are affected. The vulnerability applies specifically to instances with the wechatLoginHelper.do endpoint exposed (typically the case for WeChat single-sign-on integration). The severity and exploitability are consistent across versions, though patch status and affected version ranges are not specified in this advisory—consult Landray's official security bulletins for version-specific guidance. Organizations running Landray OA in cloud, on-premises, or hybrid deployments are at risk if the application is reachable over the network.

Exploitability

Exploitability is extremely high. The attack requires no authentication, no user interaction, and no special network positioning—any attacker with HTTP access to the wechatLoginHelper.do endpoint can craft a POST request with an injected HQL payload. Proof-of-concept evidence has been in the wild since at least March 2024. The CVSS 3.1 score of 7.5 (HIGH) reflects high confidentiality impact and network accessibility; it does not capture the full post-exploitation risk (RCE via file operations), which is conditional on database privileges. Default or misconfigured Landray deployments are particularly at risk.

Remediation

Immediate patching is the primary remediation. Landray has released security updates—verify the patch version directly from Landray's official security advisory and deployment documentation. Interim mitigation includes: (1) restricting network access to the wechatLoginHelper.do endpoint via Web Application Firewall (WAF) rules or network segmentation, (2) implementing input validation and output encoding at the application layer if patching is delayed, and (3) reducing database privileges for the Landray application account to prevent file-write operations. Disable WeChat SSO integration if not required.

Patch guidance

Contact Landray support or consult their official security bulletins for the specific patch version applicable to your Landray OA deployment. Apply patches immediately upon release and verify successful deployment by confirming the version number post-update. Landray typically provides patches through their management console or downloadable packages. Test patches in a non-production environment first, especially if your instance is handling mission-critical workflows. There is no evidence of a public patch delay, so availability should not be a blocker.

Detection guidance

Monitor HTTP POST requests to wechatLoginHelper.do for unusual 'uid' parameter values, particularly those containing HQL syntax keywords (e.g., 'from', 'select', 'where', 'and', 'or', SQL/HQL operators). Deploy a WAF rule to block requests with HQL injection patterns. Review Landray application logs for database query errors or unexpected entity class lookups. Monitor database activity for unusual SELECT queries originating from the Landray application account, especially queries accessing system or admin tables outside normal workflows. Watch for file-write operations initiated by the database service. Implement alerting on authentication log anomalies (e.g., admin account access from unexpected sources or times).

Why prioritize this

This vulnerability merits immediate remediation attention. It is unauthenticated, trivially exploitable, and permits direct access to administrator credentials and sensitive data. The potential for RCE via database file operations creates a worm/ransomware risk in multi-tenant or interconnected environments. The fact that active exploitation was observed in March 2024 indicates attacker awareness and capability. Any organization running Landray OA should treat this as a critical incident-response priority.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication or user interaction required (AV:N, AC:L, PR:N, UI:N), resulting in high confidentiality impact (C:H) and no integrity or availability impact in the base score. However, this scoring does not fully capture the conditional RCE capability via database file operations, which could elevate real-world severity. Additionally, the fact that exploitation is already in the wild adds practical severity. Organizations should treat this as a 9+ (CRITICAL) in operational prioritization, regardless of the base CVSS score.

Frequently asked questions

Can this vulnerability be exploited without internet access to the server?

No, the vulnerability requires HTTP POST access to the wechatLoginHelper.do endpoint. If the endpoint is behind a firewall, VPN, or WAF blocking HQL injection patterns, exposure is reduced. However, if Landray OA is internet-facing or accessible on an internal network where attackers have foothold, exploitation is trivial.

Will patching alone stop exploitation, or do we need to change database permissions?

Patching is the definitive fix. However, as a defense-in-depth measure, limiting database privileges for the Landray application account (removing FILE privilege if the database is MySQL, or equivalent on other platforms) prevents the file-write RCE chain even if a patch is delayed or bypassed. Do both: patch first, harden second.

How do we know if our Landray OA instance has been exploited?

Check for HTTP POST requests to wechatLoginHelper.do with unusual 'uid' values in access logs. Review Landray application logs for database query errors, unexpected entity lookups, or failed authentication attempts. Query database logs for unusual SELECT queries from the Landray application user, especially targeting system tables. Finally, verify that administrator accounts have not been accessed from unauthorized sources or at unusual times.

Is this vulnerability disclosed yet, and will attackers have reliable exploits?

Yes, the vulnerability was documented by the Shadowserver Foundation in March 2024 and is publicly known. While full exploit code may not be universally available, the flaw is straightforward enough that competent attackers can weaponize it quickly. You should assume active exploitation is ongoing or imminent.

This intelligence is provided for informational and defensive purposes only. The analysis is based on publicly available information as of the publication date and may not reflect all aspects of the vulnerability or vendor responses. Organizations should verify patch availability and compatibility with their specific Landray OA versions directly with Landray support. No exploit code or weaponized proof-of-concept details are provided herein. SEC.co assumes no liability for actions taken based on this intelligence; security teams should independently validate findings and consult official vendor advisories before deploying patches or operational changes. Source: NVD (public-domain), retrieved 2026-08-11. Analysis generated by SEC.co (claude-haiku-4-5).

Weaknesses (CWE)

CWE-564

Related vulnerabilities