CVE-2024-10600 — AI Deep Analysis Summary

🚨 **Essence**: SQL Injection in TONGDA OA 2017. 💥 **Consequences**: Attackers can manipulate the `appid` parameter to execute arbitrary SQL commands.…

🛡️ **Root Cause**: CWE-89 (SQL Injection). 🐛 **Flaw**: The application fails to properly sanitize the `appid` input parameter before using it in SQL queries.…

🏢 **Vendor**: Tongda (Beijing Tongda Xinke Technology). 📦 **Product**: TONGDA Office Anywhere (OA 2017). 📅 **Affected Versions**: Version 2017 11.6 and earlier.…

🕵️ **Hackers Can**: Extract sensitive database contents (user credentials, internal docs). 🔄 **Modify**: Alter or delete records within the OA system.…

🔓 **Auth Requirement**: None (PR:N). 🌐 **Access**: Network accessible (AV:N). 🎯 **Complexity**: Low (AC:L). 🤝 **User Interaction**: None (UI:N). ✅ **Threshold**: VERY LOW.…

📂 **Public Exploit**: Yes. 🔗 **References**: GitHub issue #3 (LvZCh/td) and VDB entries indicate active exploitation and PoCs.…

🔍 **Self-Check**: Scan for TONGDA OA 2017 instances. 🧪 **Test**: Send crafted payloads targeting the `appid` parameter in requests.…

🛠️ **Official Fix**: Yes, implied by version cutoff (v11.6 is the last vulnerable). 📥 **Action**: Upgrade to TONGDA OA version > 11.6. 🔄 **Patch**: Apply the latest security update provided by Tongda.…

🚧 **Workaround**: If patching is delayed, block external access to the OA system. 🛡️ **WAF**: Deploy Web Application Firewall rules to filter SQL injection patterns in `appid`.…

🔥 **Urgency**: HIGH. 🚨 **Priority**: Immediate action required. 📉 **Risk**: Unauthenticated remote code execution/data leak. 📅 **Timeline**: Published Oct 2024, exploits already public.…