CVE-2024-10656
📋 TL;DR
This critical SQL injection vulnerability in Tongda OA 2017 allows remote attackers to execute arbitrary SQL commands via the mr_id parameter in /pda/meeting/apply.php. Organizations using Tongda OA 2017 versions up to 11.9 are affected, potentially exposing sensitive database information.
💻 Affected Systems
- Tongda OA 2017
📦 What is this software?
Office Anywhere by Tongda2000
Office Anywhere by Tongda2000
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including credential theft, data exfiltration, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, privilege escalation, and potential system compromise through SQL injection.
If Mitigated
Limited impact with proper input validation, WAF protection, and network segmentation in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily weaponizable by attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version of Tongda OA if available, or implement workarounds.
🔧 Temporary Workarounds
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns targeting the mr_id parameter
# Example ModSecurity rule: SecRule ARGS:mr_id "@detectSQLi" "id:1001,phase:2,deny,status:403"
URL Access Restriction
linuxBlock access to the vulnerable endpoint using web server configuration
# Apache: <Location "/pda/meeting/apply.php"> Require all denied </Location>
# Nginx: location ~ /pda/meeting/apply\.php { deny all; }
🧯 If You Can't Patch
- Implement network segmentation to isolate Tongda OA systems from critical infrastructure
- Deploy intrusion detection systems monitoring for SQL injection patterns in web traffic
🔍 How to Verify
Check if Vulnerable:
Test the /pda/meeting/apply.php endpoint with SQL injection payloads in the mr_id parameterCheck Version:
Check Tongda OA version through admin interface or version files in installation directoryVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error responses📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database queries from web application user
- Multiple failed parameter manipulation attempts
Network Indicators:
- HTTP requests to /pda/meeting/apply.php with SQL keywords in parameters
- Unusual outbound database connections from web server
SIEM Query:
source="web_server" AND (uri="/pda/meeting/apply.php" AND (param="mr_id" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "--"))