CVE-2024-0938 is a medium severity flaw (CVSS 5.5) in Tongda OA. The record says upgrading to version 11.10 addresses the issue. This guide covers who is affected, how to check your exposure, and what to do now.
What's affected
Tongda OA 2017 up to 11.9, the file /general/email/inbox/delete_webmail.php, argument WEBBODY_ID_STR.
The record gives a CVSS base score of 5.5 (Medium), vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The description recommends upgrading to 11.10, while also noting the vendor never replied. Treat the fixed version as reported, not vendor confirmed. The weakness class is CWE-89.
The record scores this 5.5 Medium. The affected page handles deleting webmail items in the inbox.
The record says exploit details have been disclosed publicly, so assume that attackers can learn how the weakness works. The record says upgrading to version 11.10 addresses the issue. It also says the vendor did not respond to the disclosure, so confirm the fix with the vendor.
How to check if you're exposed
Read the installed version in the Tongda OA admin console and compare it with 11.9 and 11.10.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether a software package in your own projects matches this CVE, and the Gold directory entry for CVE-2024-0938 keeps the record details in one place. Reachability analysis helps you separate installations where the vulnerable code can actually be hit from those where it sits unused.
For hardware and appliances, no scanner will find them unless they are in an inventory, so start with a list of every device and application of this kind on your network.
What to do now
- Identify every instance of Tongda OA in your environment, including test and forgotten systems.
- Compare the version you found with the affected range above.
- Look for a fixed release from the vendor or project. The record says upgrading to version 11.10 addresses the issue.
- Apply mitigations while you wait: upgrade to 11.10 or later, and restrict access to the system to trusted networks.
- Review logs around the affected component for unusual requests.
- Record the decision and a re-check date in your vulnerability tracker.
Why it matters
The weakness is SQL injection, CWE-89. The application builds a database query from a request value without separating data from the query text, so a crafted value can change what the query does. The usual outcomes are reading rows the caller should not see, changing data, or in some setups going further.
The fix pattern is well known: parameterized queries, input validation on fields such as sort keys, and least privilege on the database account the application uses. Applications that never received a vendor fix need those controls added around them, for example at a web application firewall or by restricting who can reach the page.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and none of the pages used for this article report exploitation in the wild.
Quick check
What is the lasting fix for this class of bug?
Use parameterized queries and validate fields such as sort keys against a fixed list.
Where can I confirm the fixed version?
Check the vendor or project advisory first. The record says upgrading to version 11.10 addresses the issue. This article is based on the NVD record and the pages listed under Sources.
Sources
- https://github.com/Yu1e/vuls/blob/main/SQL%20injection%20vulnerability%20exists%20in%20Tongda%20OA.md
- https://vuldb.com/?ctiid.252183
- https://vuldb.com/?id.252183
- Safeguard Gold record for CVE-2024-0938
Last reviewed: 19 October 2026.
