Executive brief
Landray Office Automation (OA), a popular enterprise management platform, contains a critical security flaw in its WeChat login integration. An unauthenticated attacker can remotely access the system's database to steal sensitive information, such as administrator password hashes. In some configurations, this could allow an attacker to take full control of the server, leading to data theft or total service disruption.
Technical details
An unauthenticated HQL (Hibernate Query Language) injection vulnerability exists in Landray OA's 'wechatLoginHelper.do' endpoint. The flaw is caused by a lack of input sanitization for the 'uid' POST parameter, which is concatenated directly into a filter expression passed to the Hibernate 'findList()' method. A remote, unauthenticated attacker can exploit this to execute arbitrary HQL queries, enabling the extraction of sensitive data like administrator credentials. Furthermore, if the underlying database user has sufficient privileges, the attacker may perform file-write operations to achieve remote code execution (RCE). Evidence of exploitation in the wild was reported as early as March 2024.
Affected products
- Shenzhen Landray Software Co., Ltd. Landray Office Automation (OA) All versions (unspecified range)
Timeline
- 2024-03-11: exploited: Exploitation first observed by Shadowserver Foundation
- 2026-07-02: advisory: NVD and VulnCheck published advisory details