CVE-2024-10617: Tongda2000 Office Anywhere SQLI Vulnerability

CVE-2024-10617 Overview

CVE-2024-10617 is a SQL injection vulnerability affecting Tongda Office Anywhere (Tongda OA) versions up to 11.10. The flaw resides in the /pda/workflow/check_seal.php endpoint, where the ID parameter is passed to a database query without proper sanitization. Authenticated remote attackers can manipulate this parameter to inject arbitrary SQL statements. Public disclosure of the exploit details increases the likelihood of opportunistic abuse against exposed Tongda OA instances. The weakness is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Remote attackers with low-privileged access can extract, modify, or delete database records by injecting SQL through the ID parameter of check_seal.php.

Affected Products

• Tongda2000 Office Anywhere versions up to and including 11.10
• /pda/workflow/check_seal.php endpoint
• Deployments exposing the PDA workflow module to untrusted networks

Discovery Timeline

• 2024-11-01 - CVE-2024-10617 published to the National Vulnerability Database (NVD)
• 2024-11-04 - Last updated in NVD database

Technical Details for CVE-2024-10617

Vulnerability Analysis

The vulnerability is a classic SQL injection in a PHP-based workflow component of Tongda OA. The check_seal.php script accepts the ID parameter from an HTTP request and concatenates it into a SQL query without parameterization or input validation. Attackers can supply crafted values to break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires only low-level authenticated access and no user interaction. Because Tongda OA stores workflow records, user credentials, and document metadata in its backend database, successful injection can disclose sensitive business information. The impact spans limited confidentiality, integrity, and availability of data within the affected application instance.

Root Cause

The root cause is improper neutralization of user input (CWE-89) inside check_seal.php. The application directly inserts the ID parameter into a SQL statement rather than using prepared statements or stored procedures with bound parameters. No allow-list filtering or type casting is applied before the parameter reaches the database layer.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to /pda/workflow/check_seal.php with a malicious ID value containing SQL metacharacters and payloads such as UNION SELECT clauses or boolean-based blind injection probes. The server processes the query and returns data or behavior the attacker can use to enumerate the database schema and extract records. Public proof-of-concept discussion is referenced in the GitHub Issue Discussion and VulDB #282628.

No verified exploit code is reproduced here. See the linked VulDB CTI Report #282628 for additional technical context.

Detection Methods for CVE-2024-10617

Indicators of Compromise

• HTTP requests targeting /pda/workflow/check_seal.php containing SQL metacharacters such as ', ", --, ;, or UNION in the ID parameter
• Unusual database errors logged by the Tongda OA application around the workflow check_seal endpoint
• Spikes in outbound database query volume originating from the Tongda OA web process
• Web access logs showing repeated requests to check_seal.php from a single source with varying ID values

Detection Strategies

• Deploy web application firewall (WAF) signatures that match SQL injection patterns against the ID parameter of check_seal.php
• Inspect application and database logs for syntax errors, malformed queries, or unexpected UNION/SELECT clauses tied to the workflow module
• Correlate authentication events with subsequent access to the vulnerable endpoint to identify low-privileged accounts probing the parameter

Monitoring Recommendations

• Forward Tongda OA web server, PHP error, and database audit logs to a centralized logging or SIEM platform for correlation
• Alert on any HTTP 500 responses from /pda/workflow/check_seal.php that follow requests containing encoded SQL syntax
• Baseline normal query patterns from the OA application and flag deviations such as schema enumeration against information_schema

How to Mitigate CVE-2024-10617

Immediate Actions Required

• Restrict network access to the Tongda OA application so that only trusted users and networks can reach /pda/workflow/check_seal.php
• Apply WAF rules to block SQL metacharacters in the ID parameter until a vendor patch is verified and deployed
• Audit Tongda OA user accounts and rotate credentials for any account that may have been used to probe the endpoint
• Review database audit logs for evidence of prior exploitation, including unexpected SELECT activity against sensitive tables

Patch Information

At the time of publication, no vendor advisory or patch reference is listed in the NVD record. Administrators should monitor the Tongda OA vendor site and the VulDB entry #282628 for updated remediation guidance. Until an official fix is available, apply the workarounds below and upgrade to a release later than 11.10 once one is published by the vendor.

Workarounds

• Place the Tongda OA application behind a reverse proxy or WAF that enforces strict input validation on the ID parameter
• Limit database account privileges used by the OA application to the minimum required, preventing schema enumeration and write operations from the web tier
• Disable or restrict the /pda/workflow/check_seal.php endpoint via web server configuration if the PDA workflow feature is not required
• Enforce strong authentication and monitor authenticated sessions interacting with the workflow module

# Example nginx location block to restrict access to the vulnerable endpoint
location = /pda/workflow/check_seal.php {
    allow 10.0.0.0/8;        # internal management network only
    deny  all;
    # Block requests where ID contains SQL metacharacters
    if ($arg_ID ~* "('|\"|--|;|union|select|/\*)") {
        return 403;
    }
    fastcgi_pass php_backend;
}