CVE-2024-10732: Tongda2000 Office Anywhere SQLi Flaw

CVE-2024-10732 Overview

CVE-2024-10732 is a SQL injection vulnerability in Tongda Office Anywhere (Tongda OA) versions 2017 through 11.10. The flaw resides in the /module/word_model/view/index.php endpoint, where the query_str parameter is passed to backend database queries without proper sanitization [CWE-89]. Remote authenticated attackers can manipulate the parameter to execute arbitrary SQL statements against the underlying database. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against unpatched deployments.

Critical Impact

Authenticated remote attackers can inject SQL queries through the query_str parameter, exposing data confidentiality, integrity, and availability across affected Tongda OA installations.

Affected Products

• Tongda2000 Office Anywhere 2017
• Tongda2000 Office Anywhere versions up to 11.10
• Deployments exposing /module/word_model/view/index.php

Discovery Timeline

• 2024-11-03 - CVE-2024-10732 published to the National Vulnerability Database (NVD)
• 2024-11-04 - Last updated in NVD database

Technical Details for CVE-2024-10732

Vulnerability Analysis

The vulnerability is a server-side SQL injection in the Tongda OA word_model module. The PHP handler at /module/word_model/view/index.php accepts a user-controlled query_str argument and concatenates it into a SQL statement without sufficient input validation or parameterized query enforcement. As a result, attackers can break out of the intended query context and append arbitrary SQL clauses.

The attack is conducted over the network and requires low privileges. Successful injection allows database content extraction, modification of records, or further enumeration of the OA platform's internal data structures. Tongda OA is widely deployed for enterprise document workflows in Chinese-speaking markets, which expands the impact surface for organizations exposing the application to untrusted networks.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The query_str parameter is incorporated into a dynamic SQL query string without prepared statements, parameter binding, or strict input filtering. Any quote, comment, or UNION operator embedded in the parameter is interpreted by the database engine.

Attack Vector

An attacker sends a crafted HTTP request to /module/word_model/view/index.php with a malicious payload supplied through the query_str parameter. Because the attack vector is network-based and the public disclosure includes exploit details, automated scanners and opportunistic actors can incorporate the technique into routine reconnaissance. See the GitHub Issue Discussion for technical details on the affected request path.

Detection Methods for CVE-2024-10732

Indicators of Compromise

• HTTP requests to /module/word_model/view/index.php containing SQL metacharacters such as single quotes, UNION SELECT, --, /*, or SLEEP( in the query_str parameter.
• Unexpected database errors logged by the Tongda OA application referencing the word_model module.
• Outbound DNS or HTTP callbacks originating from the OA web server during request processing, indicating out-of-band SQL injection.

Detection Strategies

• Inspect web server access logs for query_str values that contain encoded SQL syntax, long parameter lengths, or repeated payload variants from a single source IP.
• Deploy web application firewall (WAF) signatures targeting SQL injection patterns on the word_model endpoint.
• Correlate authentication logs with anomalous query activity to identify accounts being abused for injection attempts.

Monitoring Recommendations

• Enable database query logging on the MySQL instance backing Tongda OA and alert on queries containing concatenated user input from the word_model handler.
• Monitor for spikes in 500-series HTTP responses from /module/word_model/view/index.php, which often accompany failed injection attempts.
• Forward web, application, and database logs to a centralized analytics platform to enable cross-source correlation of injection activity.

How to Mitigate CVE-2024-10732

Immediate Actions Required

• Restrict network exposure of Tongda OA management interfaces to trusted internal networks or VPN users only.
• Audit account activity on the OA platform and disable or rotate credentials for accounts exhibiting suspicious query behavior.
• Deploy WAF rules to block requests containing SQL metacharacters in the query_str parameter against the word_model endpoint.

Patch Information

At the time of publication, no vendor advisory or official patch URL is listed in the NVD record. Administrators should monitor Tongda2000 vendor channels for an updated build addressing the word_model SQL injection and apply it as soon as it becomes available. Refer to VulDB #282901 for tracking updates and remediation references.

Workarounds

• Implement strict input validation at a reverse proxy to allow only expected character classes in the query_str parameter.
• Apply temporary virtual patching through a WAF using signatures for SQL injection targeting /module/word_model/view/index.php.
• Limit database account privileges used by the Tongda OA application to the minimum required, reducing the impact of successful injection.