CVE-2024-10600: Tongda2000 Office Anywhere SQLi Flaw

CVE-2024-10600 Overview

A SQL injection vulnerability has been identified in Tongda OA 2017, a popular office automation software. The vulnerability exists in the file pda/appcenter/submenu.php, where the appid parameter is improperly handled, allowing attackers to inject malicious SQL commands. This flaw enables remote attackers to manipulate database queries without authentication, potentially leading to unauthorized data access, modification, or deletion.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract sensitive data, modify database contents, or potentially escalate access within affected Tongda OA 2017 installations through network-based attacks.

Affected Products

• Tongda OA 2017 up to version 11.6
• Tongda2000 Office Anywhere 2017

Discovery Timeline

• 2024-10-31 - CVE-2024-10600 published to NVD
• 2024-11-04 - Last updated in NVD database

Technical Details for CVE-2024-10600

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) stems from improper neutralization of special elements used in SQL commands within the Tongda OA application. The vulnerable endpoint pda/appcenter/submenu.php accepts user-supplied input through the appid parameter and incorporates this data directly into SQL queries without adequate sanitization or parameterization. This allows attackers to craft malicious input that alters the intended SQL query structure.

The exploit has been publicly disclosed, increasing the risk of active exploitation. The network-accessible nature of this vulnerability means attackers can target any internet-exposed Tongda OA 2017 installation without requiring prior authentication or user interaction.

Root Cause

The root cause of CVE-2024-10600 is the lack of proper input validation and sanitization for the appid parameter in submenu.php. The application directly concatenates user-supplied input into SQL queries rather than using prepared statements or parameterized queries. This classic SQL injection pattern allows attackers to break out of the intended query context and execute arbitrary SQL commands.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable pda/appcenter/submenu.php endpoint with a malicious appid parameter value. The injected SQL payload is then executed by the database server with the privileges of the application's database user.

Technical details and proof-of-concept information have been documented in the GitHub Issue Discussion and additional vulnerability tracking is available through VulDB #282612.

Detection Methods for CVE-2024-10600

Indicators of Compromise

• Unusual HTTP requests to pda/appcenter/submenu.php containing SQL syntax characters such as single quotes, semicolons, or SQL keywords in the appid parameter
• Database error messages in application logs indicating malformed SQL queries or injection attempts
• Unexpected database queries or operations logged by database audit mechanisms
• Anomalous data access patterns or bulk data extraction from the Tongda OA database

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SQL injection patterns targeting the submenu.php endpoint
• Deploy intrusion detection systems (IDS) with signatures for common SQL injection attack patterns
• Enable verbose logging on the Tongda OA application server and monitor for suspicious parameter values
• Configure database activity monitoring to alert on anomalous queries from the application context

Monitoring Recommendations

• Monitor HTTP access logs for requests to pda/appcenter/submenu.php with unusual or overly long appid parameter values
• Set up alerts for database errors related to SQL syntax that may indicate injection attempts
• Review database audit logs for unauthorized data access or modification patterns
• Implement network traffic analysis to detect potential data exfiltration following successful exploitation

How to Mitigate CVE-2024-10600

Immediate Actions Required

• Restrict network access to Tongda OA 2017 installations to trusted networks and users only
• Implement web application firewall rules to filter SQL injection attempts targeting the vulnerable endpoint
• Consider temporarily disabling the pda/appcenter/submenu.php functionality if not business-critical
• Review database permissions to ensure the application uses least-privilege database accounts

Patch Information

At the time of this advisory, no official patch information has been released by Tongda. Organizations should monitor official Tongda channels for security updates addressing this SQL injection vulnerability. It is recommended to upgrade to a patched version as soon as one becomes available from the vendor.

For additional technical details and tracking, refer to the VulDB submission.

Workarounds

• Deploy a web application firewall (WAF) configured to block SQL injection patterns on requests to the vulnerable endpoint
• Implement input validation at the network perimeter to sanitize or reject requests containing SQL metacharacters in the appid parameter
• Restrict access to the pda/appcenter/ directory through web server configuration to authorized users or IP ranges only
• Consider placing the Tongda OA application behind a VPN to limit exposure to trusted network segments

# Example: Apache .htaccess rule to restrict access to vulnerable endpoint
<Files "submenu.php">
    <RequireAll>
        Require ip 10.0.0.0/8
        Require ip 192.168.0.0/16
    </RequireAll>
</Files>