CVE-2024-10658

Executive Summary

CVE-2024-10658 is a critical SQL injection vulnerability discovered in Tongda OA (Office Automation) versions up to 11.10. The flaw resides in the /pda/approve_center/check_seal.php file, where the ID parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to complete database compromise, data exfiltration, and further lateral movement within the network. The exploit has been publicly disclosed, increasing the risk of widespread exploitation. No official patch has been released at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom PHP application (Tongda OA) and should be treated as a third-party software supply chain risk. Organizations using Tongda OA must assess their exposure and apply virtual patching or other mitigations until an official fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and the exploit is publicly available. Immediate action is required.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the check_seal.php script. The application likely constructs a SQL query by directly concatenating the user-supplied ID parameter without proper sanitization or parameterized queries.

Vulnerable Code Snippet (Conceptual):

<?php
$id = $_GET['ID'];
$sql = "SELECT * FROM seals WHERE id = $id";
$result = mysqli_query($conn, $sql);
?>

An attacker can manipulate the ID parameter to break out of the intended query structure. For example:

http://target.com/pda/approve_center/check_seal.php?ID=1 UNION SELECT username,password FROM users--

This would return the username and password fields from the users table, potentially exposing credentials.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$id = $_GET['ID'];
$sql = "SELECT * FROM seals WHERE id = $id";
$result = mysqli_query($conn, $sql);

Patched Code (Conceptual):

$id = intval($_GET['ID']);
$sql = "SELECT * FROM seals WHERE id = $id";
$result = mysqli_query($conn, $sql);

The patched version uses intval() to cast the input to an integer, preventing SQL injection. Alternatively, prepared statements should be used:

$stmt = $conn->prepare("SELECT * FROM seals WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Tongda OA instance (version 11.10 or earlier) in a controlled environment.
2. Use a tool like sqlmap to automate exploitation:

   sqlmap -u "http://target.com/pda/approve_center/check_seal.php?ID=1" --batch --dbs
   

3. Manual exploitation example:

   http://target.com/pda/approve_center/check_seal.php?ID=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   

4. Extract database names, tables, and sensitive data.

Exploit-DB Code: None available.

Blue Team

Detection:

• Monitor web server logs for suspicious SQL injection patterns in the ID parameter.
• Look for requests containing UNION, SELECT, OR 1=1, --, or other SQL keywords.
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection attempts.

Hunting:

• Search for outbound database connections from the web server to unknown IPs.
• Check for unexpected database queries or large data transfers.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /pda/approve_center/check_seal.php with abnormal ID parameter values.
  • SQL injection patterns in URL parameters (e.g., UNION, SELECT, OR 1=1).
• File System:
  • Modified or new files in the Tongda OA webroot (e.g., webshells).
  • Suspicious entries in web server access logs.
• Database:
  • Unauthorized queries or data exports.
  • New user accounts or modified permissions.

Detection Engineering

YARA Rule

rule CVE_2024_10658_SQLi_CheckSeal {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-10658 in Tongda OA"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10658"
    strings:
        $s1 = "check_seal.php" nocase
        $s2 = "ID=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR " nocase
        $s6 = "--" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2024-10658 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting Tongda OA check_seal.php
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - '/pda/approve_center/check_seal.php'
        cs-uri-query|contains|word: 
            - 'UNION'
            - 'SELECT'
            - 'OR '
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10658 SQL Injection Attempt"; flow:to_server,established; content:"/pda/approve_center/check_seal.php"; http_uri; content:"ID="; http_uri; pcre:"/(UNION|SELECT|OR\s|--)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: Deploy a WAF rule to block SQL injection patterns in the ID parameter.
2. Input Validation: Implement strict input validation (e.g., only allow numeric values for the ID parameter).
3. Network Segmentation: Isolate the Tongda OA server from critical internal networks.

Long-Term Fix:

• Apply the official patch from Tongda when released.
• Upgrade to a patched version of Tongda OA.
• Conduct a full security audit of the application.

Valters IT Signature: This report was generated by Valters IT DevSecOps & CTI Expert System.