Executive brief
vhr (微人事) is a human resources management system that ships with hardcoded default administrator credentials in its database initialization script. Attackers can immediately gain full administrative access to the system without authentication, allowing them to read sensitive employee and payroll data, modify HR records, or perform other administrative actions depending on system capabilities.
Technical details
The vulnerability is a use-of-default-credentials issue (CWE-1392) in the vhr.sql seed data file. The database initialization script contains INSERT statements that set admin account passwords to "123" with BCrypt hashing, and the application does not force a password change on first login. An unauthenticated remote attacker can directly log in with username "admin" and password "123" via the /doLogin endpoint, gaining full administrative access. The vulnerability affects vhr 1.0-SNAPSHOT and is publicly exploitable; no patch or vendor response has been reported.
Affected products
- lenve vhr 1.0-SNAPSHOT
Timeline
- 2026-09-13: disclosed
- other: Exploit is publicly available; vendor was contacted early but did not respond