CVE-2024-3620: Kortex Lite Advocate Office Management SQLI

CVE-2024-3620 Overview

CVE-2024-3620 is a SQL injection vulnerability in SourceCodester Kortex Lite Advocate Office Management System 1.0. The flaw resides in the /control/adds.php script, where the name, gender, dob, email, mobile, and address parameters are passed to a database query without proper sanitization. Authenticated attackers can inject arbitrary SQL statements remotely across the network. The exploit has been publicly disclosed, tracked as VulDB entry VDB-260276, and maps to [CWE-89]. The weakness impacts the confidentiality, integrity, and availability of the underlying database.

Critical Impact
Remote authenticated attackers can execute arbitrary SQL queries through adds.php, enabling data theft, record tampering, and possible database takeover.

Affected Products

SourceCodester Kortex Lite Advocate Office Management System 1.0
Mayurik Advocate Office Management System (CPE cpe:2.3:a:mayurik:advocate_office_management_system:1.0)
Deployments exposing /control/adds.php to authenticated users

Discovery Timeline

2024-04-11 - CVE-2024-3620 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3620

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] in the record-creation workflow of the Kortex Lite Advocate Office Management System. The /control/adds.php endpoint accepts client-supplied values for name, gender, dob, email, mobile, and address, then concatenates them into a SQL statement without parameterization or input filtering.

An attacker with valid application credentials can supply crafted values in any of these fields to break out of the intended query context. Because the request is served over HTTP and requires no user interaction, exploitation is straightforward once authentication is achieved. Impact spans the full CIA triad because the compromised query executes with the application's database privileges.

Successful exploitation can read arbitrary tables, modify client and case records, or drop application data. Where the database user has file or system privileges, attackers can chain the flaw toward broader host compromise.

Root Cause

The root cause is direct interpolation of untrusted POST parameters into a SQL query in adds.php. The application does not use prepared statements, parameter binding, or type-safe validation before executing the query.

Attack Vector

Exploitation requires network access to the application and valid credentials. An attacker submits a form or crafted POST request to /control/adds.php and injects SQL metacharacters into any of the six affected parameters. The malicious payload is executed by the backend database engine when the query runs.

Detailed reproduction steps and payload examples are documented in the public CVE submission on GitHub and the VulDB advisory.

Detection Methods for CVE-2024-3620

Indicators of Compromise

Web server logs showing POST requests to /control/adds.php containing SQL keywords such as UNION, SELECT, SLEEP, or -- in the name, gender, dob, email, mobile, or address fields.
Database error messages surfaced in HTTP responses referencing MySQL syntax or unexpected columns.
Anomalous rows in the client or case tables containing SQL fragments or encoded payloads.

Detection Strategies

Deploy a web application firewall rule that inspects POST bodies to adds.php for common SQL injection tokens and quote/comment sequences.
Enable MySQL general query logging or slow query logging temporarily to identify malformed statements originating from adds.php.
Correlate authenticated session activity with database write volume spikes to surface abuse of the add-record workflow.

Monitoring Recommendations

Alert on repeated HTTP 500 responses from /control/adds.php, which often accompany injection probing.
Monitor for outbound database connections executing statements outside the application's normal schema.
Track authentication events preceding suspicious adds.php traffic to identify compromised accounts.

How to Mitigate CVE-2024-3620

Immediate Actions Required

Restrict access to /control/adds.php to trusted internal networks or VPN users until a fix is applied.
Rotate credentials for any account that has interacted with the affected instance.
Review database logs for unauthorized INSERT, UPDATE, SELECT, or DROP activity dating back to April 2024.

Patch Information

No official vendor patch has been published for Kortex Lite Advocate Office Management System 1.0 at the time of NVD update. Operators should track the VulDB entry and the GitHub advisory for remediation guidance. Where source access is available, replace concatenated SQL in adds.php with prepared statements using mysqli or PDO parameter binding.

Workarounds

Place the application behind a WAF and enable SQL injection signatures targeting the six affected parameters.
Enforce strict input validation at a reverse proxy: reject non-alphanumeric characters in name, gender, mobile, and dob fields.
Grant the application database user only the minimum privileges required, revoking FILE, DROP, and cross-schema access.
Take the application offline if it is not business-critical until an upstream fix is available.

bash

# Example WAF rule (ModSecurity) blocking SQLi tokens on adds.php
SecRule REQUEST_URI "@streq /control/adds.php" \
  "phase:2,chain,deny,status:403,id:1002024,\
   msg:'CVE-2024-3620 SQLi attempt on adds.php'"
  SecRule ARGS:name|ARGS:gender|ARGS:dob|ARGS:email|ARGS:mobile|ARGS:address \
    "@detectSQLi" "t:none,t:urlDecodeUni"