CVE-2024-7638: Advocate Office Management System SQLi Flaw

CVE-2024-7638 Overview

CVE-2024-7638 is a SQL injection vulnerability in SourceCodester Kortex Lite Advocate Office Management System 1.0. The flaw resides in the delete_client.php script, where the id parameter is concatenated into a SQL query without proper sanitization [CWE-89]. Authenticated attackers can manipulate the id argument over the network to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed deployments. The application is also known as Mayurik Advocate Office Management System and is used by legal practices to manage client records.

Critical Impact

Remote attackers with low-level privileges can manipulate the id parameter in delete_client.php to execute arbitrary SQL queries, potentially exposing or altering client records stored in the application database.

Affected Products

• Mayurik (SourceCodester) Kortex Lite Advocate Office Management System 1.0
• Component: delete_client.php
• CPE: cpe:2.3:a:mayurik:advocate_office_management_system:1.0

Discovery Timeline

• 2024-08-12 - CVE-2024-7638 published to the National Vulnerability Database (NVD)
• 2024-08-15 - Last updated in NVD database

Technical Details for CVE-2024-7638

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] in the client deletion workflow of the Kortex Lite Advocate Office Management System. The delete_client.php endpoint accepts an id parameter that is incorporated directly into a SQL DELETE statement without parameterization or input validation.

An attacker who can reach the application can supply crafted input through the id argument to break out of the intended query context. This allows execution of attacker-controlled SQL against the backend database. The attack is performed remotely and requires only low-privilege access to the application.

Successful exploitation can lead to unauthorized data manipulation, disclosure of sensitive client records, and integrity loss across application tables. Because the affected endpoint performs a destructive database operation, injected statements may also be used to remove or alter rows beyond the targeted record.

Root Cause

The root cause is the use of unsanitized user input in dynamic SQL construction. The delete_client.php script concatenates the HTTP-supplied id value into a SQL query rather than using prepared statements or parameterized queries. No server-side input validation enforces a numeric or whitelisted format for the parameter.

Attack Vector

The attack vector is network-based and targets the id parameter passed to delete_client.php. An attacker authenticated to the application sends a crafted HTTP request containing SQL meta-characters in the id value. The injected payload is interpreted by the backend database engine as part of the DELETE statement. Public exploit details are documented in the GitHub SQLi Exploit Documentation and tracked in VulDB #274059.

Detection Methods for CVE-2024-7638

Indicators of Compromise

• HTTP requests to delete_client.php containing SQL meta-characters such as single quotes, UNION, SELECT, OR 1=1, or comment sequences (--, #) in the id parameter.
• Web server logs showing non-numeric values in the id query string for delete_client.php.
• Unexpected DELETE operations against application tables outside normal user workflows.
• Database error messages referencing syntax errors originating from the client deletion endpoint.

Detection Strategies

• Inspect web server access logs for anomalous query strings sent to delete_client.php, focusing on encoded SQL keywords and tautologies.
• Deploy a web application firewall (WAF) signature set targeting SQL injection patterns and alert on matches against the Kortex application paths.
• Correlate authentication events with high-frequency requests to delete_client.php from a single source to surface enumeration attempts.

Monitoring Recommendations

• Enable database query logging and review for malformed or unusually long DELETE statements referencing the clients table.
• Monitor application audit logs for client records being removed outside business hours or by unexpected user accounts.
• Track outbound responses for verbose database errors that could aid attackers in refining payloads.

How to Mitigate CVE-2024-7638

Immediate Actions Required

• Restrict network access to the Kortex Lite Advocate Office Management System to trusted internal networks or VPN users until a fix is applied.
• Audit application accounts and remove unused or shared credentials that could be abused to reach the vulnerable endpoint.
• Review backups of the application database to ensure clean restore points exist in case of data tampering.
• Inspect logs since the published disclosure date (2024-08-12) for evidence of exploitation against delete_client.php.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2024-7638 at the time of last modification (2024-08-15). Operators of Mayurik Advocate Office Management System 1.0 should monitor the VulDB advisory and the SourceCodester project page for updated builds. Until an official fix is available, source-level remediation requires replacing dynamic SQL in delete_client.php with parameterized queries (e.g., PDO prepared statements) and enforcing strict server-side validation that the id parameter is an integer.

Workarounds

• Deploy a WAF rule that blocks non-numeric values or SQL meta-characters in the id parameter of delete_client.php.
• Apply a virtual patch at the reverse proxy layer to reject requests where id does not match a strict integer regular expression.
• Restrict the database account used by the application to least-privilege permissions, removing DROP and broad DELETE rights where feasible.
• Disable or remove the delete_client.php endpoint if client deletion is not an active business requirement.

# Example Nginx workaround: only allow numeric id values to reach delete_client.php
location = /delete_client.php {
    if ($arg_id !~ "^[0-9]+$") {
        return 403;
    }
    fastcgi_pass php_upstream;
}