MetaGuru's HCM system has a high-risk SQL Injection vulnerability (CVE-2026-15804, CVSS 8.8). Authenticated remote attackers can inject SQL commands
The Taiwan Vulnerability Notification Platform (TVN) published a vulnerability advisory numbered TVN-202607005 on July 15, 2026, revealing a high-risk SQL Injection vulnerability in the MetaGuru-developed enterprise Human Capital Management (HCM) system[1]. This vulnerability corresponds to the international standard CVE ID CVE-2026-15804, with a CVSS 3.1 score of 8.8 (High). Assessment indicators show that attackers can remotely exploit the vulnerability over the network without a complex environment and cause significant data damage[1]. The vulnerability reporter is BTtea (Chinese Information Security International). The attack path explicitly requires authentication first, classifying it as an "authenticated remote attack" type, meaning attackers must obtain a legitimate account before injecting malicious SQL commands using this vulnerability[1][3].
SQL Injection (SQLi) is an attack technique that modifies or retrieves database data by inserting malicious SQL syntax into input fields[5]. In the CVE-2026-15804 case, attackers exploited the lack of proper input validation and filtering mechanisms for specific parameters in the HCM system to embed malicious SQL commands into requests[1]. When applications do not use parameterized queries or prepared statements but instead directly concatenate user input with SQL commands as strings, attackers can break the query structure and execute unauthorized database operations[6][9].
The technical core of this vulnerability lies in the application treating user input not as pure data but as part of executable code[5]. Attackers can inject commands such as UNION SELECT, DROP TABLE, or INSERT to directly read sensitive data (confidentiality), modify or delete critical records (integrity), or even cause database service disruption (availability)[1][3]. According to OWASP's defense guidelines, if developers do not stop using string concatenation for dynamic queries and do not implement parameterized queries, the system is highly exposed to such risks[6]. Notably, although this vulnerability requires authentication, once breached, its consequences are equivalent to possessing a high-privilege database account; attackers can bypass application-level access controls and directly operate on the backend database.
According to the TWCERT advisory, the affected product is the HCM system developed by MetaGuru[1]. The official has not yet released a confirmed patched version; relevant vulnerability databases show "No patch information available"[5]. Since the HCM system typically stores large amounts of employee personal information, salary data, and organizational structure information, a SQL Injection attack could lead to massive personal data leaks, violating regulations under the Personal Data Protection Act[1].
In the CVSS score, AV:N (Attack Vector: Network) indicates attackers can initiate attacks remotely over the network without physical contact; AC:L (Attack Complexity: Low) shows low attack difficulty; PR:L (Privileges Required: Low) confirms attackers need only low privileges (e.g., a regular employee account) to exploit it; C:H, I:H, and A:H represent high impact on confidentiality, integrity, and availability, respectively[1]. This combination indicates the vulnerability has extremely high exploitability and destructive potential, posing a serious threat to organizations relying on the HCM system for daily operations.
Protection strategies for CVE-2026-15804 should address both immediate patching and long-term defense. Since no officially confirmed patched version is currently available, the primary measure is to contact MetaGuru to obtain a security update[5].
Before patching is completed, organizations can implement the following temporary protection measures: First, deploy a Web Application Firewall (WAF) and configure rules to intercept requests containing common SQL Injection characteristics (e.g., single quotes, UNION, SELECT keywords), especially filtering suspicious parameters[2][7]. Second, implement the Principle of Least Privilege for database permissions, ensuring the database account used by the HCM application has only the necessary minimum privileges to prevent attackers from obtaining high privileges like sysadmin via injection[5][7]. Additionally, disable dangerous extended stored procedures on SQL Server (e.g., xp_cmdshell) to prevent attackers from executing system commands or performing remote code execution further via SQL Injection[2][4]. Finally, regularly audit database and application logs to detect abnormal query behavior or signs of attack attempts[2].