CVE-2024-10616
📋 TL;DR
This critical SQL injection vulnerability in Tongda OA allows remote attackers to execute arbitrary SQL commands by manipulating the saleId parameter in the /pda/workflow/webSignSubmit.php file. Organizations using Tongda OA versions up to 11.9 are affected, potentially leading to unauthorized data access or system compromise.
💻 Affected Systems
- Tongda OA
📦 What is this software?
Office Anywhere by Tongda2000
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive data exfiltration, privilege escalation to administrative access, and potential remote code execution on the underlying server.
Likely Case
Unauthorized access to sensitive business data stored in the OA system, including employee information, workflow data, and potentially authentication credentials.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification privileges.
🎯 Exploit Status
The exploit has been publicly disclosed on GitHub, making it easily accessible to attackers. The SQL injection appears to be straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check with Tongda OA vendor for security updates. If a patch is released, apply it according to vendor instructions. Monitor official channels for security advisories.
🔧 Temporary Workarounds
Block vulnerable endpoint
allRestrict access to the vulnerable /pda/workflow/webSignSubmit.php file using web server configuration or WAF rules.
# Apache: RewriteRule ^/pda/workflow/webSignSubmit\.php$ - [F]
# Nginx: location ~ ^/pda/workflow/webSignSubmit\.php$ { deny all; }
Input validation at WAF
allImplement web application firewall rules to block SQL injection patterns in the saleId parameter.
# ModSecurity: SecRule ARGS:saleId "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in the application code
- Apply network segmentation to isolate Tongda OA systems and restrict database access
🔍 How to Verify
Check if Vulnerable:
Test if /pda/workflow/webSignSubmit.php is accessible and accepts saleId parameter. Attempt SQL injection payloads like ' OR '1'='1 in saleId parameter.Check Version:
Check Tongda OA version in admin interface or configuration files. Typically found in /inc/oa_config.php or similar.Verify Fix Applied:
Verify the vulnerable endpoint is no longer accessible or properly validates input. Test with SQL injection payloads to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts following SQL injection patterns
- Access to /pda/workflow/webSignSubmit.php with suspicious parameters
Network Indicators:
- HTTP requests to /pda/workflow/webSignSubmit.php containing SQL keywords in parameters
- Unusual outbound database connections from web servers
SIEM Query:
source="web_logs" AND uri="/pda/workflow/webSignSubmit.php" AND (param="saleId" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|--|#|'|\")")