CVE-2024-3621: Advocate Office Management System SQLi Flaw

CVE-2024-3621 Overview

CVE-2024-3621 is a SQL injection vulnerability in SourceCodester Kortex Lite Advocate Office Management System 1.0. The flaw resides in /control/register_case.php, where multiple user-supplied parameters flow into SQL statements without sanitization. Attackers can manipulate the title, case_no, client_name, court, case_type, case_stage, legel_acts, description, filling_date, hearing_date, opposite_lawyer, total_fees, and unpaid arguments to inject arbitrary SQL. The exploit has been publicly disclosed and is tracked as VulDB entry VDB-260277. The weakness is classified under CWE-89.

Critical Impact
Authenticated remote attackers can execute arbitrary SQL against the backend database, exposing case records, client data, and legal filings while enabling record modification or deletion.

Affected Products

Mayurik Advocate Office Management System 1.0
SourceCodester Kortex Lite Advocate Office Management System 1.0
Component: /control/register_case.php

Discovery Timeline

2024-04-11 - CVE-2024-3621 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3621

Vulnerability Analysis

The vulnerability is a classic SQL injection in a PHP-based case registration workflow. When a user submits the case registration form, the register_case.php script concatenates POST parameters directly into SQL queries executed against the application database. Because no parameterized queries or input sanitization are applied, an attacker with valid application credentials can craft payloads that break out of the intended query context.

Successful exploitation grants full read and write access to the underlying database, including sensitive attorney-client records, case metadata, financial fields such as total_fees and unpaid, and hearing schedules. Attackers can enumerate tables through UNION-based queries or extract data via boolean and time-based techniques. The attack is remotely reachable over the network and requires only privileges available to a standard authenticated user.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Input from the case registration form is passed to the database layer without prepared statements, escaping, or type validation. All thirteen form fields identified in the advisory are affected, indicating a systemic lack of input handling in the module.

Attack Vector

Exploitation requires network access to the application and authenticated privileges to reach the case registration endpoint. An attacker sends a crafted HTTP POST request to /control/register_case.php with malicious SQL syntax embedded in any vulnerable parameter. The database interprets the injected clauses, enabling data exfiltration, authentication bypass through record manipulation, or destructive queries.

A public proof of concept is available through the GitHub CVE Submission Report. No verified code examples are reproduced here. Refer to the disclosure for payload structure and reproduction steps.

Detection Methods for CVE-2024-3621

Indicators of Compromise

HTTP POST requests to /control/register_case.php containing SQL metacharacters such as ', --, UNION SELECT, SLEEP(, or INFORMATION_SCHEMA.
Unexpected database errors or long query response times originating from the case registration workflow.
New or modified records in case-related tables that do not correspond to legitimate user activity.
Unusual outbound data volumes from the web application host correlating with authenticated sessions.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies for SQL injection signatures targeting the affected parameters.
Enable database query logging and alert on queries referencing the case table with abnormal syntax such as stacked statements or comment tokens.
Correlate authenticated session activity against expected form submission patterns to flag automated injection attempts.

Monitoring Recommendations

Monitor web server access logs for repeated requests to register_case.php from a single session within short intervals.
Track database user account activity for schema enumeration queries against information_schema or system tables.
Alert on application-level 500 errors originating from the case registration endpoint, which often accompany injection probing.

How to Mitigate CVE-2024-3621

Immediate Actions Required

Restrict access to the Kortex Lite Advocate Office Management System to trusted networks or place it behind a VPN until a fix is applied.
Revoke or rotate credentials for any accounts that may have been used to reach the vulnerable endpoint.
Deploy WAF signatures blocking SQL injection payloads targeting /control/register_case.php parameters.
Audit database records for unauthorized modifications, particularly in case and financial tables.

Patch Information

No vendor patch is referenced in the NVD entry or vendor advisories for CVE-2024-3621. Organizations running Mayurik Advocate Office Management System 1.0 should contact the vendor for remediation guidance or migrate to an alternative platform. Refer to VulDB #260277 for the latest vulnerability status.

Workarounds

Apply virtual patching at the WAF layer to reject requests containing SQL metacharacters in the identified parameters.
Enforce least-privilege database accounts so the application connects with a role limited to required tables and operations.
Implement server-side input validation and parameterized queries in a forked or in-house maintained build if source code access is available.
Disable the case registration module for non-essential users until remediation is complete.

bash

# Example ModSecurity rule to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@streq /control/register_case.php" \
    "phase:2,chain,deny,status:403,id:1002024,msg:'Block SQLi attempt on register_case.php'"
    SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|;|information_schema)" \
        "t:none,t:urlDecodeUni"