CVE-2024-3618: Advocate Office Management SQLI Flaw

CVE-2024-3618 Overview

CVE-2024-3618 is a SQL injection vulnerability in SourceCodester Kortex Lite Advocate Office Management System 1.0, developed by Mayurik. The flaw resides in an unknown function of the file /control/activate_case.php. Attackers manipulate the id argument to inject arbitrary SQL statements into the backend database. The vulnerability is exploitable remotely and requires high privileges but no user interaction. The exploit has been publicly disclosed and is tracked as VDB-260274 [CWE-89].

Critical Impact
Remote authenticated attackers can execute arbitrary SQL queries against the application database, leading to full compromise of confidentiality, integrity, and availability of stored case management data.

Affected Products

Mayurik Advocate Office Management System 1.0
SourceCodester Kortex Lite Advocate Office Management System 1.0
Deployments exposing /control/activate_case.php to authenticated users

Discovery Timeline

2024-04-11 - CVE-2024-3618 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3618

Vulnerability Analysis

The vulnerability affects the activate_case.php endpoint within the /control/ directory of Kortex Lite Advocate Office Management System 1.0. The application accepts an id parameter from HTTP requests and concatenates it directly into a SQL statement without parameterization or input sanitization. This is a classic SQL injection pattern classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

An authenticated attacker with access to the control panel can inject SQL fragments through the id parameter. The injection allows arbitrary read and write operations against the underlying database. Successful exploitation results in disclosure of case records, tampering with legal case data, and potential deletion of records.

Root Cause

The root cause is missing input validation and the absence of prepared statements when handling the id parameter in /control/activate_case.php. User-supplied data flows directly into a dynamically constructed SQL query.

Attack Vector

Exploitation occurs over the network against the vulnerable web endpoint. The attacker sends a crafted HTTP request with a malicious payload in the id parameter. Because the exploit is public through the VulDB entry and the referenced GitHub submission, automated scanners and opportunistic attackers may weaponize it against exposed instances.

The vulnerability manifests when the server processes the manipulated id value in /control/activate_case.php and passes it to the database engine without escaping. For technical proof-of-concept details, see the GitHub CVE Submission and the VulDB entry #260274.

Detection Methods for CVE-2024-3618

Indicators of Compromise

HTTP requests to /control/activate_case.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment sequences (--, #) in the id parameter.
Web server or PHP error logs referencing SQL syntax errors originating from activate_case.php.
Anomalous database queries returning large result sets or accessing tables outside normal case management workflows.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the id parameter on requests to /control/activate_case.php for SQL injection signatures.
Enable database query logging and alert on queries containing suspicious keywords or unusual UNION-based patterns tied to the activate_case workflow.
Correlate authenticated session activity with unexpected database read volumes for the same user context.

Monitoring Recommendations

Monitor authentication logs for privileged accounts accessing the control panel, since exploitation requires high privileges.
Track outbound traffic from the application server for data exfiltration patterns following suspicious requests to the vulnerable endpoint.
Baseline normal query patterns against the case management database and alert on deviations.

How to Mitigate CVE-2024-3618

Immediate Actions Required

Restrict network access to /control/activate_case.php to trusted administrative IP ranges through firewall or reverse proxy rules.
Rotate credentials for any accounts with access to the control panel to limit the pool of attackers who can reach the vulnerable endpoint.
Review web server and database logs for prior exploitation attempts referencing the id parameter.

Patch Information

No vendor patch has been published for CVE-2024-3618 at the time of this writing. Consult the VulDB advisory and the vendor for updates. Organizations running Kortex Lite Advocate Office Management System 1.0 should evaluate whether continued use of the product is acceptable given the absence of a fix.

Workarounds

Apply virtual patching through a WAF rule that blocks non-numeric values or SQL metacharacters in the id parameter on /control/activate_case.php.
Modify activate_case.php in-house to use parameterized queries (PDO prepared statements or mysqli_prepare) and validate that id is a strict integer before use.
Disable the endpoint entirely if the activate case function is not required for daily operations.

bash

# Example nginx rule to block SQL metacharacters in the id parameter
location /control/activate_case.php {
    if ($arg_id ~* "(['\"]|--|/\*|union|select|sleep|benchmark)") {
        return 403;
    }
}