CVE-2024-1252 is a medium severity SQL injection in Tongda OA 2017, up to version 11.9, in the attendance delete page. NVD scores it 5.5. The record says upgrading to version 11.10 addresses it, so move to 11.10 or later and restrict network access.
What's affected
The record names Tongda OA 2017, up to version 11.9. The weak spot is the file general/attendance/manage/ask_duty/delete.php, with the ASK_DUTY_ID argument. The remote attack path and the public disclosure both come from the VulDB entry, number 252991, which the record paraphrases.
NVD scores it 5.5, which is Medium. The vector shows adjacent network access and low privileges, so the reach is limited to people on the same network who have an account.
The record says upgrading to version 11.10 is able to address this issue, and recommends upgrading the affected component. Treat 11.10 as the minimum, and confirm the build with the vendor.
The sibling CVE-2024-1251 affects another page in the same office suite and its record says versions up to 11.10 are affected, so confirm which build you run before you assume you are covered.
Weakness class: CWE-89. The NVD record carries the vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L and a score of 5.5.
How to check if you're exposed
Look for the file named in the record, the file general/attendance/manage/ask_duty/delete.php, and review how it builds its SQL. If you cannot read the code, check web logs for requests to that path with unusual values in the ASK_DUTY_ID parameter.
If you are not sure whether the product is installed, search your server inventory and application list for its name, since small business software like this often sits on a single forgotten host.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Find every installation of Tongda OA 2017 and record the version.
- Upgrade Tongda OA to version 11.10 or later, as the record recommends, and confirm the build with the vendor.
- Until a fix exists, limit who can reach the application, for example by placing it behind a VPN or an allow list, and block public access to the file general/attendance/manage/ask_duty/delete.php.
- Watch web server logs for requests to the affected route and for new or changed files.
- Plan a move to a maintained product if the vendor does not respond.
Why it matters
SQL injection (CWE-89) means the value of the ASK_DUTY_ID argument ends up inside a database query as text, so crafted input can change what the query does. The standard fix is parameterised queries, where the database treats input strictly as data.
Depending on the database account the application uses, the outcome can be reading, changing or deleting records. The record does not describe the exact impact, and I have not tested the product, so the lowered score reflects the vector and not a worst case. The record includes a fix recommendation, so there is a clear path to remediation.
Quick check
Is CVE-2024-1252 known to be exploited?
The KEV flag in the record is false. The record does say the exploit details have been disclosed publicly, so do not wait for exploitation reports before acting.
Where can I read the original report?
The record cites VulDB entry 252991 and an outside write up. I could not retrieve them, so check them yourself for the proof of concept level detail, which this post leaves out on purpose.
Sources
Last reviewed: 19 October 2026.
