# CVE-2023-6655: Hongjing e-HR 2020 - SQLi

> Live exploitation tracking for CVE-2023-6655 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-6655

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.3
- **Public exploit available:** Yes
- **Affected products:** Hongjing e-HR
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

## Description

A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /w_selfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument parentid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247358 is the identifier assigned to this vulnerability.

## CrowdSec analysis

[CVE-2023-6655](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-6655) is a vulnerability impacting the Hongjing e-HR platform that allows remote attackers to perform SQL injection on the login interface.

CrowdSec has been tracking this vulnerability and its exploits since 27th of November 2024.

CrowdSec network observations suggest that most exploitation of CVE-2023-6655 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2023-6655. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attack patterns are characterized by accesses to URLs starting with `/w_selfservice/oauthservlet/%2e./.%2e/`.

## Timeline

- 2023-12-10: CVE Published. CVE-2023-6655 is published to NVD.
- 2024-11-27: Rule Released. CrowdSec releases a rule to detect CVE-2023-6655 exploitation attempts against the CrowdSec Network.
- 2024-11-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-6655 for the first time.

## References

- https://vuldb.com/?id.247358

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-6655) follows observed exploitation activity for CVE-2023-6655. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.