CVE-2024-10656: Tongda2000 Office Anywhere SQLi Flaw

CVE-2024-10656 Overview

CVE-2024-10656 is a SQL injection vulnerability affecting Tongda Office Anywhere (Tongda OA) versions 2017 through 11.9. The flaw resides in the /pda/meeting/apply.php endpoint, where the mr_id parameter is passed to backend SQL queries without proper sanitization [CWE-89]. Remote attackers with low-level privileges can manipulate the parameter to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the risk of opportunistic attacks against exposed installations.

Critical Impact

Authenticated remote attackers can extract or modify database contents through the vulnerable mr_id parameter in the meeting application module, potentially compromising sensitive organizational data stored in Tongda OA.

Affected Products

• Tongda2000 Office Anywhere 2017
• Tongda2000 Office Anywhere versions up to and including 11.9
• Deployments exposing /pda/meeting/apply.php to untrusted networks

Discovery Timeline

• 2024-11-01 - CVE-2024-10656 published to the National Vulnerability Database
• 2024-11-04 - Last updated in NVD database

Technical Details for CVE-2024-10656

Vulnerability Analysis

The vulnerability is a SQL injection flaw [CWE-89] in the meeting apply module of Tongda OA. The apply.php script under /pda/meeting/ accepts a mr_id argument that flows directly into a SQL query without parameterization or input validation. Attackers can manipulate this parameter to alter query logic, read arbitrary tables, or modify database records. The attack is initiated over the network and requires no user interaction, though low-level authentication is required based on the CVSS vector. Public disclosure of the exploit details lowers the technical bar for adversaries targeting unpatched instances.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The mr_id parameter received via HTTP is concatenated into a SQL statement inside apply.php rather than being bound through a prepared statement. This allows attacker-controlled input to break out of the intended query context and append additional SQL clauses such as UNION SELECT or boolean-based payloads.

Attack Vector

The attack vector is network-based. An attacker authenticated to the Tongda OA application sends a crafted HTTP request to /pda/meeting/apply.php with a malicious value in the mr_id parameter. Because the parameter is interpolated directly into the SQL query, payloads such as classic union-based or time-based blind SQL injection techniques succeed against the underlying database. Refer to the GitHub Issue Discussion and the VulDB entry #282671 for additional technical context.

Detection Methods for CVE-2024-10656

Indicators of Compromise

• HTTP requests to /pda/meeting/apply.php containing SQL metacharacters such as single quotes, UNION, SLEEP(, or comment sequences -- and /* in the mr_id parameter
• Web server access logs showing repeated requests to the meeting apply endpoint with abnormally long or encoded mr_id values
• Database error messages or unusually long response times tied to requests against the meeting module

Detection Strategies

• Deploy web application firewall (WAF) signatures that inspect the mr_id parameter for SQL injection patterns on the /pda/meeting/apply.php path
• Enable verbose query logging on the backend database and alert on syntactically malformed queries originating from the Tongda OA application user
• Correlate authenticated session activity with abnormal SQL query volume to identify post-authentication exploitation attempts

Monitoring Recommendations

• Continuously monitor outbound data transfer from the Tongda OA database host for signs of bulk data exfiltration
• Review authentication logs for low-privilege accounts initiating sessions immediately followed by access to the meeting module
• Baseline normal request patterns to /pda/meeting/apply.php and alert on deviations in request structure or frequency

How to Mitigate CVE-2024-10656

Immediate Actions Required

• Restrict network access to the Tongda OA web interface, exposing it only to trusted internal networks or via VPN
• Audit user accounts and disable or rotate credentials for any low-privilege accounts that are not actively required
• Deploy WAF rules that block SQL injection payloads targeting the mr_id parameter on /pda/meeting/apply.php

Patch Information

As of the last NVD update on 2024-11-04, no vendor advisory or official patch has been published in the references for CVE-2024-10656. Administrators should monitor the vendor channels and VulDB entry #282671 for forthcoming fixes and apply updates as soon as they become available.

Workarounds

• Place the Tongda OA application behind a reverse proxy enforcing strict input validation on query and POST parameters
• Apply virtual patching at the WAF layer to reject requests where mr_id contains non-numeric characters
• Limit database account privileges used by the Tongda OA application to the minimum required, removing rights such as FILE, CREATE, or cross-database access

# Example ModSecurity rule to block SQL injection patterns against the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /pda/meeting/apply.php" \
    "id:1010656,phase:2,deny,status:403,\
     chain,msg:'CVE-2024-10656 Tongda OA SQLi attempt'"
    SecRule ARGS:mr_id "@rx [^0-9]" "t:none,t:urlDecodeUni"