Cleartext Storage Enables SQL Injection in HR Systems

Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injection. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

Casky was already ahead

This CVE exploits attack patterns that Casky's 233matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

HUMANIST Digital Human Resources versions 26.0 through 26.0.x contain a critical vulnerability (CVSS 9.8) that stores sensitive information in cleartext, creating a gateway for SQL injection attacks. This flaw affects HR departments and organizations relying on HUMANIST for employee data management, exposing payroll records, personal identification information, and authentication credentials to unauthorized access. The combination of cleartext storage (CWE-312) with SQL injection capabilities allows attackers to bypass application logic entirely, query or modify database contents directly, and potentially escalate privileges within the HR infrastructure.

Casky's 233 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this vulnerability through MITRE ATT&CK technique TA0006 (Credential Access). Practitioners using Casky would observe detection findings that correlate cleartext credential exposure patterns with attempted SQL injection payloads—such as unusual database queries with concatenated user input, authentication attempts using harvested plaintext credentials, and lateral movement indicators following initial HR system compromise. The platform's skill set would highlight how threat actors first extract credentials from unencrypted storage, then weaponize those credentials combined with SQL injection to access additional sensitive data or pivot across the network, enabling practitioners to map the complete attack chain and implement compensating controls before version 26.1 is deployed.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

233 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15721.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0006

Investigate the attack patterns behind CVE-2026-15721

Casky has 233 skills that investigate the attack patterns behind CVE-2026-15721. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn