CVE-2024-10600

Executive Summary

CVE-2024-10600 is a critical SQL injection vulnerability discovered in Tongda OA 2017, affecting versions up to 11.6. The flaw resides in the pda/appcenter/submenu.php file, where the appid parameter is not properly sanitized, allowing an attacker to inject arbitrary SQL commands. This vulnerability is remotely exploitable without authentication, posing a severe risk to data confidentiality, integrity, and availability. The exploit has been publicly disclosed, increasing the urgency for mitigation. As of this report, no official patch is available from Tongda.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary enterprise application (Tongda OA) commonly deployed in Chinese organizations. The risk is primarily to the direct users of this software.

CVSS Breakdown & Threat Level

While the official CVSS vector is not provided, based on the description (critical, remote, unauthenticated SQL injection), a reasonable CVSS v3.1 score would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote exploitability, no authentication required, and public exploit code makes this a high-priority threat.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the pda/appcenter/submenu.php endpoint. The appid parameter is likely used in a SQL query without proper sanitization or parameterization. An attacker can inject SQL commands by manipulating this parameter.

Example vulnerable code (conceptual):

$appid = $_GET['appid'];
$sql = "SELECT * FROM apps WHERE id = $appid";
$result = mysqli_query($conn, $sql);

Exploitation Mechanics:

1. The attacker sends a crafted HTTP GET request to the vulnerable endpoint.
2. The appid parameter contains SQL injection payloads (e.g., 1 UNION SELECT ...).
3. The database executes the malicious SQL, potentially extracting data, modifying records, or executing system commands (if database permissions allow).

Impact:

• Full database compromise (user credentials, sensitive data).
• Potential for remote code execution via xp_cmdshell (if MSSQL) or INTO OUTFILE (if MySQL).
• Lateral movement within the network.

Vulnerable vs. Patched Code

Since no official patch is available, we can only describe the vulnerable pattern and the secure alternative.

Vulnerable Code (Conceptual):

<?php
$appid = $_GET['appid'];
$sql = "SELECT * FROM apps WHERE id = $appid";
$result = mysqli_query($conn, $sql);
?>

Patched Code (Conceptual - Parameterized Query):

<?php
$appid = $_GET['appid'];
$stmt = $conn->prepare("SELECT * FROM apps WHERE id = ?");
$stmt->bind_param("i", $appid);
$stmt->execute();
$result = $stmt->get_result();
?>

Key Difference: The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Tongda OA 2017 instance (up to 11.6).
• A tool like sqlmap or curl.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://target.com/pda/appcenter/submenu.php?appid=1
   

2. Test for SQL injection:

   http://target.com/pda/appcenter/submenu.php?appid=1'
   

   If an error is returned, the endpoint is likely vulnerable.

3. Automated exploitation with sqlmap:

   sqlmap -u "http://target.com/pda/appcenter/submenu.php?appid=1" --batch --dbs
   

4. Manual exploitation (example for MySQL):

   http://target.com/pda/appcenter/submenu.php?appid=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

Blue Team (Defensive)

Detection:

• Monitor for SQL injection patterns in HTTP requests to /pda/appcenter/submenu.php.
• Look for unusual characters in the appid parameter (e.g., ', ", --, UNION, SELECT).

Mitigation:

• Immediately isolate affected systems if possible.
• Implement a Web Application Firewall (WAF) with rules to block SQL injection.
• Apply virtual patching if available from your security vendor.
• Monitor database logs for suspicious queries.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /pda/appcenter/submenu.php with abnormal appid parameter values.
• SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Outbound database connections from the web server to unusual IPs.

File IOCs:

• Modified or new files in the web root (e.g., webshells).
• Unusual entries in web server access logs.

Log IOCs:

• Database logs showing UNION, SELECT, INTO OUTFILE, or xp_cmdshell commands.
• Web server logs with appid containing SQL keywords.

Detection Engineering

YARA Rule

rule CVE_2024_10600_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-10600 in Tongda OA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10600"
    strings:
        $s1 = "/pda/appcenter/submenu.php" nocase
        $s2 = "appid=" nocase
        $sqli1 = " UNION " nocase
        $sqli2 = " SELECT " nocase
        $sqli3 = " OR 1=1" nocase
        $sqli4 = "' OR '" nocase
    condition:
        $s1 and $s2 and 1 of ($sqli*)
}

Sigma Rule

title: CVE-2024-10600 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against Tongda OA /pda/appcenter/submenu.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/pda/appcenter/submenu.php?appid="
    keywords:
        - " UNION "
        - " SELECT "
        - " OR 1=1"
        - "' OR '"
        - "1' AND 1=1"
    condition: selection and keywords
falsepositives:
    - Legitimate use of SQL keywords in appid (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-10600 Tongda OA SQL Injection Attempt";
    flow:to_server,established;
    content:"/pda/appcenter/submenu.php"; http_uri;
    content:"appid="; http_uri;
    pcre:"/(UNION|SELECT|OR\s+1=1|' OR ')/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:cve,2024-10600;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the network if possible.
2. Apply virtual patching via WAF or IPS to block SQL injection patterns.
3. Review and restrict database user permissions (e.g., remove FILE, PROCESS, SUPER privileges).
4. Enable detailed logging on the web server and database.

Long-term Fix:

• Since no official patch is available, consider:
  • Code-level fix: Modify pda/appcenter/submenu.php to use parameterized queries.
  • Upgrade: Contact Tongda for an updated version or migrate to a different OA solution.
  • Compensating controls: Implement strict input validation and output encoding.

Monitoring:

• Continuously monitor for exploitation attempts using the provided detection rules.
• Review database logs for unauthorized queries.

Valters IT