CVE-2024-10602
📋 TL;DR
This CVE describes a critical SQL injection vulnerability in Tongda OA 2017 through version 11.9. Attackers can exploit the /general/approve_center/list/input_form/data_picker_link.php file by manipulating the dataSrc parameter to execute arbitrary SQL commands. Organizations using affected versions of Tongda OA are vulnerable to remote attacks.
💻 Affected Systems
- Tongda OA
📦 What is this software?
Office Anywhere by Tongda2000
Office Anywhere by Tongda2000
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and potential remote code execution through database functions.
Likely Case
Unauthorized data access, extraction of sensitive information, and potential authentication bypass.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit details have been publicly disclosed on GitHub, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
1. Check for vendor updates beyond version 11.9. 2. If no patch is available, implement workarounds immediately. 3. Consider upgrading to a supported version if available.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the vulnerable endpoint.
Access Restriction
linuxRestrict access to /general/approve_center/list/input_form/data_picker_link.php via web server configuration.
# Apache: <Location "/general/approve_center/list/input_form/data_picker_link.php">
# Order deny,allow
# Deny from all
# </Location>
# Nginx: location ~ /general/approve_center/list/input_form/data_picker_link.php { deny all; }
🧯 If You Can't Patch
- Implement network segmentation to isolate Tongda OA systems from critical infrastructure.
- Deploy intrusion detection systems to monitor for SQL injection attempts against the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Check if your Tongda OA version is 11.9 or earlier and if the file /general/approve_center/list/input_form/data_picker_link.php exists and is accessible.Check Version:
Check Tongda OA admin panel or configuration files for version information.Verify Fix Applied:
Test the vulnerable endpoint with SQL injection payloads to confirm they are blocked or no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple requests to /general/approve_center/list/input_form/data_picker_link.php with SQL keywords
Network Indicators:
- HTTP requests containing SQL injection patterns targeting the dataSrc parameter
SIEM Query:
source="web_logs" AND uri="/general/approve_center/list/input_form/data_picker_link.php" AND (query="*SELECT*" OR query="*UNION*" OR query="*OR*1=1*")