CVE-2024-1251 is a medium severity SQL injection in Tongda OA 2017, up to version 11.10, in the email outbox delete page. NVD scores it 5.5 and the record says exploit details are public. The vendor did not respond, so there is no confirmed fix. Limit network access.
What's affected
The record names Tongda OA 2017, up to version 11.10. The weak spot is the file general/email/outbox/delete.php, with the DELETE_STR argument. The remote attack path and the public disclosure both come from the VulDB entry, number 252990, which the record paraphrases.
NVD scores it 5.5, which is Medium. The vector shows adjacent network access and low privileges, which explains the medium score. VulDB called it critical in its text, so the two ratings differ.
No fix is confirmed for 11.10 and earlier. The record says the vendor did not respond, so ask the vendor directly and do not assume an upgrade exists. Note that the sibling CVE-2024-1252 in the same product says 11.10 addresses its issue, so versions after 11.10 may contain other fixes, but this record does not say that for CVE-2024-1251.
This product has more than one reported injection point. CVE-2024-1252 covers another file in the same office suite, so audit the whole application, not one page.
Weakness class: CWE-89. The NVD record carries the vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L and a score of 5.5.
How to check if you're exposed
Look for the file named in the record, the file general/email/outbox/delete.php, and review how it builds its SQL. If you cannot read the code, check web logs for requests to that path with unusual values in the DELETE_STR parameter.
If you are not sure whether the product is installed, search your server inventory and application list for its name, since small business software like this often sits on a single forgotten host.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Find every installation of Tongda OA 2017 and record the version.
- Ask the vendor for a patched release and apply it as soon as it is available.
- Until a fix exists, limit who can reach the application, for example by placing it behind a VPN or an allow list, and block public access to the file general/email/outbox/delete.php.
- Watch web server logs for requests to the affected route and for new or changed files.
- Plan a move to a maintained product if the vendor does not respond.
Why it matters
SQL injection (CWE-89) means the value of the DELETE_STR argument ends up inside a database query as text, so crafted input can change what the query does. The standard fix is parameterised queries, where the database treats input strictly as data.
Depending on the database account the application uses, the outcome can be reading, changing or deleting records. The record does not describe the exact impact, and I have not tested the product, so the lowered score reflects the vector and not a worst case. The record says the vendor was contacted early and did not respond in any way.
Quick check
Is CVE-2024-1251 known to be exploited?
The KEV flag in the record is false. The record does say the exploit details have been disclosed publicly, so do not wait for exploitation reports before acting.
Where can I read the original report?
The record cites VulDB entry 252990 and an outside write up. I could not retrieve them, so check them yourself for the proof of concept level detail, which this post leaves out on purpose.
Sources
Last reviewed: 19 October 2026.
