CVE-2024-3619: Kortex Lite Advocate Office Management SQL Injection

CVE-2024-3619 is a critical SQL injection vulnerability in Kortex Lite Advocate Office Management System affecting the addcase_stage.php file. Attackers can exploit this flaw remotely to manipulate database queries. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-3619 Overview

CVE-2024-3619 is a SQL injection vulnerability in SourceCodester Kortex Lite Advocate Office Management System 1.0 (also tracked as Mayurik Advocate Office Management System). The flaw resides in the /control/addcase_stage.php script, where the cname parameter is passed to a database query without proper sanitization. Attackers with authenticated access can manipulate the parameter to inject arbitrary SQL statements. The issue is classified under CWE-89 and has been publicly disclosed, including a proof-of-concept write-up.

Critical Impact
Successful exploitation allows remote attackers to read, modify, or delete data in the underlying database, potentially exposing legal case records, client information, and administrative credentials.

Affected Products

SourceCodester Kortex Lite Advocate Office Management System 1.0
Mayurik Advocate Office Management System 1.0
CPE: cpe:2.3:a:mayurik:advocate_office_management_system:1.0

Discovery Timeline

2024-04-11 - CVE-2024-3619 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3619

Vulnerability Analysis

The vulnerability is a classic SQL injection issue affecting the case-stage management module of the application. The /control/addcase_stage.php endpoint accepts a cname parameter supplied by an authenticated user. That value is concatenated into a SQL statement rather than bound as a parameter, allowing an attacker to alter the query logic.

Exploitation requires network access to the web application and valid credentials, since the endpoint sits behind the administrative control panel. Once authenticated, an attacker can inject SQL clauses to enumerate schema data, dump records, or escalate impact through stacked queries where supported by the database driver.

The vulnerability affects confidentiality, integrity, and availability of the backend data store. Advocate office deployments typically host sensitive case files, client identifiers, and billing records, making the data at risk highly sensitive.

Root Cause

The root cause is missing input validation and lack of parameterized queries in addcase_stage.php. The cname argument is placed directly into a SQL statement, letting metacharacters such as single quotes, UNION, and comment sequences change the query's intent.

Attack Vector

The attack is delivered over the network against the application's HTTP interface. The attacker submits a crafted cname value through the case-stage form or a direct request to the vulnerable script. No user interaction is required beyond the attacker's own request, and exploitation is scriptable using standard SQL injection tooling. See the public disclosure and VulDB entry #260275 for technical details.

Detection Methods for CVE-2024-3619

Indicators of Compromise

HTTP POST or GET requests to /control/addcase_stage.php containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP( in the cname parameter.
Unexpected database errors or verbose SQL error messages returned by addcase_stage.php in web server logs.
Anomalous outbound queries from the application database user, especially against information_schema or users tables.

Detection Strategies

Deploy web application firewall (WAF) signatures for SQL injection targeting the cname parameter and the /control/addcase_stage.php path.
Enable database query logging and alert on queries originating from the application user that reference sensitive tables outside normal application workflow.
Correlate authenticated session activity with sudden bursts of failed or malformed queries to identify injection attempts.

Monitoring Recommendations

Monitor authentication logs for administrative logins followed by rapid, repeated requests to case-management endpoints.
Baseline normal request patterns to /control/addcase_stage.php and alert on payloads exceeding typical field lengths or containing SQL keywords.
Track unusual data export or read volumes from the database process serving the Kortex application.

How to Mitigate CVE-2024-3619

Immediate Actions Required

Restrict access to the /control/ administrative directory to trusted networks or via VPN to reduce exposure.
Rotate credentials for all administrative accounts of the Advocate Office Management System.
Deploy WAF rules to block SQL injection payloads against the cname parameter until a code-level fix is applied.

Patch Information

At the time of the last NVD update, no official vendor patch has been published for SourceCodester Kortex Lite Advocate Office Management System 1.0. Organizations running this software should treat it as unmaintained and evaluate migration to a supported case-management platform. Track the VulDB analysis for any future vendor response.

Workarounds

Modify addcase_stage.php to use parameterized queries or prepared statements via PDO or MySQLi rather than string concatenation for the cname value.
Apply server-side input validation that rejects SQL metacharacters in fields expected to contain plain text.
Enforce least-privilege database accounts so the application user cannot access tables outside its functional scope, limiting damage from any successful injection.

bash

# Example WAF rule concept (ModSecurity) to block SQLi against the vulnerable endpoint
SecRule REQUEST_URI "@contains /control/addcase_stage.php" \
  "phase:2,deny,status:403,id:1002024361,\
   chain,msg:'Possible SQLi in cname parameter (CVE-2024-3619)'"
  SecRule ARGS:cname "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|;|')" "t:none"