CVE-2024-10947: Guangzhou Tuchuang Interlib SQLi Flaw

CVE-2024-10947 Overview

CVE-2024-10947 is a SQL injection vulnerability in the Guangzhou Tuchuang Interlib Library Cluster Automation Management System through version 2.0.1. The flaw resides in the /interlib/order/BatchOrder endpoint when invoked with cmdACT=admin_order&xsl=adminOrder_OrderList.xsl. Attackers manipulate the bookrecno parameter to inject arbitrary SQL statements. The vulnerability is remotely exploitable and requires authenticated access with high privileges. Public exploit details have been disclosed, and the vendor did not respond to disclosure attempts. The issue is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact
Remote authenticated attackers can inject SQL through the bookrecno parameter to read or modify backend library management data.

Affected Products

Guangzhou Tuchuang Interlib Library Cluster Automation Management System up to version 2.0.1
/interlib/order/BatchOrder endpoint handler
Any deployment exposing the admin_order command interface

Discovery Timeline

2024-11-07 - CVE-2024-10947 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10947

Vulnerability Analysis

The vulnerability exists in the batch order administration handler of the Interlib platform. The application accepts the bookrecno request parameter and concatenates it directly into a SQL statement without parameterization or sanitization. This allows an attacker to break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires network access to the Interlib web interface and valid credentials with administrative order privileges. Successful injection can expose bibliographic records, patron data, and administrative metadata stored in the backend database. Depending on the database engine's privileges, an attacker may also modify records or pivot to further backend operations.

Root Cause

The root cause is unsafe string concatenation in the query construction path for adminOrder_OrderList.xsl. The bookrecno argument is passed to the data access layer without input validation, type coercion, or prepared statement binding. This violates secure coding guidance under [CWE-74] for output-context neutralization.

Attack Vector

The attack is delivered over HTTP against the /interlib/order/BatchOrder endpoint. An authenticated administrator or an attacker who has obtained privileged credentials submits a crafted request with a malicious bookrecno value. No user interaction is required beyond issuing the request. Because the exploit method has been publicly disclosed, opportunistic scanning against exposed Interlib deployments is plausible.

See the VulDB advisory and the Shikangsi Wiki write-up for exploitation details.

Detection Methods for CVE-2024-10947

Indicators of Compromise

HTTP requests to /interlib/order/BatchOrder containing SQL metacharacters such as ', --, UNION, or SLEEP( inside the bookrecno parameter.
Requests with abnormally long or encoded values for bookrecno combined with cmdACT=admin_order.
Database error responses returned to the client that reference SQL syntax or table names originating from Interlib requests.

Detection Strategies

Deploy web application firewall signatures that inspect the bookrecno argument for SQL injection patterns.
Enable database query logging and alert on unexpected UNION, INFORMATION_SCHEMA, or time-based delay statements originating from the Interlib service account.
Correlate authentication events for administrative accounts with subsequent requests to admin_order to identify credential misuse.

Monitoring Recommendations

Baseline normal BatchOrder request patterns and flag deviations in parameter length, character sets, and response codes.
Monitor outbound database traffic volume from the Interlib application server for signs of bulk exfiltration.
Retain HTTP access logs for the Interlib web tier for at least 90 days to support retrospective hunting.

How to Mitigate CVE-2024-10947

Immediate Actions Required

Restrict network exposure of the Interlib web interface to trusted management networks or VPN segments.
Rotate credentials for all administrative accounts capable of reaching the admin_order command.
Enforce least privilege on the database account used by Interlib so injected queries cannot read outside the application schema.

Patch Information

No vendor patch is available. According to the disclosure record, Guangzhou Tuchuang did not respond to the researcher's outreach. Operators should track the VulDB entry for any future vendor advisory and plan compensating controls in the interim.

Workarounds

Place a reverse proxy or WAF in front of Interlib and block requests whose bookrecno parameter contains non-numeric characters.
Disable or firewall the /interlib/order/BatchOrder route if the batch order administration feature is not required.
Apply database-layer input filtering by wrapping the Interlib data source with a stored procedure interface that enforces typed parameters.

bash

# Example NGINX rule to reject non-numeric bookrecno values
location /interlib/order/BatchOrder {
    if ($arg_bookrecno !~ "^[0-9]+$") {
        return 403;
    }
    proxy_pass http://interlib_backend;
}