CVE-2024-10658
📋 TL;DR
This critical SQL injection vulnerability in Tongda OA allows remote attackers to execute arbitrary SQL commands via the ID parameter in /pda/approve_center/check_seal.php. Organizations using Tongda OA versions up to 11.10 are affected, potentially exposing sensitive database information.
💻 Affected Systems
- Tongda OA
📦 What is this software?
Office Anywhere by Tongda2000
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, and potential remote code execution through database functions.
Likely Case
Unauthorized data access, including sensitive business information, user credentials, and approval records from the OA system.
If Mitigated
Limited impact with proper input validation and WAF rules blocking SQL injection patterns.
🎯 Exploit Status
Exploit code is publicly available on GitHub, making this easily weaponizable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
1. Check Tongda official website for security updates. 2. Upgrade to version above 11.10 if available. 3. Apply any vendor-provided patches for this specific vulnerability.
🔧 Temporary Workarounds
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns targeting the ID parameter.
# Example ModSecurity rule: SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQL Injection Attempt'
File Access Restriction
allRestrict access to the vulnerable PHP file using web server configuration.
# Apache: <Location "/pda/approve_center/check_seal.php">
Order deny,allow
Deny from all
</Location>
# Nginx: location ~ /pda/approve_center/check_seal\.php$ { return 403; }
🧯 If You Can't Patch
- Implement strict input validation for all ID parameters in the application layer.
- Deploy database monitoring to detect unusual SQL query patterns and failed login attempts.
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads: curl -X POST 'http://[target]/pda/approve_center/check_seal.php' -d 'ID=1' OR test with SQLi testing tools.Check Version:
Check Tongda OA version in admin panel or configuration files. Typically found in /inc/oa_config.php or similar.Verify Fix Applied:
Attempt exploitation with known payloads and verify they are blocked or return error messages instead of database information.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple requests to /pda/approve_center/check_seal.php with SQL keywords in parameters
- Failed database queries from the OA application
Network Indicators:
- HTTP POST requests to the vulnerable endpoint with SQL injection payloads in ID parameter
- Unusual database connection patterns from the web server
SIEM Query:
source="web_logs" AND uri="/pda/approve_center/check_seal.php" AND (param="ID" AND value MATCH "(?i)(union|select|insert|update|delete|drop|--|#|/*)")