An unauthenticated user can send a crafted POST request to the wechatLoginHelper.do endpoint, injecting Hibernate Query Language into the uid parameter. The injection bypasses input sanitization in the string‑concatenated filter passed to Hibernate’s findList() call, allowing arbitrary queries of Hibernate entity classes. This enables the attacker to read sensitive information such as administrator password hashes, and if the database user has write privileges, to create files on the server, which can lead to remote code execution.

Landry Office Automation (OA) from Shenzhen Landray Software Co., Ltd. No specific release information is disclosed, implying that all current versions of the product could be vulnerable until a vendor patch is applied.

The CVSS score of 8.7 categorises the issue as high severity, while the EPSS score of <1% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated HTTP POST request to wechatLoginHelper.do, exploiting the lack of authentication and inadequate input filtering to inject malicious HQL.