CVE-2024-7642: Advocate Office Management System SQLi Flaw

CVE-2024-7642 Overview

CVE-2024-7642 is a SQL injection vulnerability in SourceCodester Kortex Lite Advocate Office Management System 1.0. The flaw resides in the activate_act.php file, where the id parameter is passed to a database query without proper sanitization [CWE-89]. Attackers can manipulate this parameter to inject arbitrary SQL statements remotely. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The vulnerability requires low privileges and no user interaction, making it accessible to authenticated low-tier users.

Critical Impact

Remote attackers with low-level credentials can inject SQL queries to read, modify, or delete data stored in the application's backend database.

Affected Products

• Mayurik Advocate Office Management System 1.0
• SourceCodester Kortex Lite Advocate Office Management System 1.0
• activate_act.php endpoint within affected builds

Discovery Timeline

• 2024-08-12 - CVE-2024-7642 published to NVD
• 2024-08-15 - Last updated in NVD database

Technical Details for CVE-2024-7642

Vulnerability Analysis

The vulnerability stems from unsanitized user input passed to the id parameter in activate_act.php. The application concatenates the parameter value directly into a SQL query string. This allows attackers to break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires only network access to the application and a low-privileged account. Because the attack is launched over HTTP, it can be automated using standard tooling such as sqlmap. The Exploit Prediction Scoring System (EPSS) reports a probability of 0.155% as of May 2026, indicating low observed exploit activity despite public disclosure.

Root Cause

The root cause is the absence of parameterized queries or prepared statements when handling the id GET parameter. The PHP code constructs a SQL string using direct concatenation of the user-supplied value, violating standard secure coding practices for database access.

Attack Vector

An authenticated attacker sends a crafted HTTP request to the activate_act.php endpoint with a malicious payload in the id parameter. Typical payloads use UNION-based or boolean-based blind injection techniques to extract data from the underlying MySQL database. Refer to the GitHub Exploit Documentation for proof-of-concept payloads.

Detection Methods for CVE-2024-7642

Indicators of Compromise

• HTTP requests to activate_act.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or OR 1=1
• Database error messages logged in web server output following requests to activate_act.php
• Unusual volumes of database query activity originating from low-privileged user sessions

Detection Strategies

• Deploy web application firewall (WAF) rules to inspect query strings sent to activate_act.php for SQL injection signatures
• Enable verbose database query logging to identify malformed or unexpected SQL statements
• Correlate authentication logs with subsequent abnormal query patterns to identify abused accounts

Monitoring Recommendations

• Monitor HTTP access logs for repeated requests to activate_act.php with varying id values from a single source
• Alert on database errors (e.g., MySQL syntax errors) tied to the application user account
• Track outbound data volumes from the application's database tier to detect bulk extraction attempts

How to Mitigate CVE-2024-7642

Immediate Actions Required

• Restrict network access to the Kortex Lite Advocate Office Management System to trusted internal users only
• Review application logs for prior exploitation attempts against activate_act.php
• Rotate database credentials and review user privileges within the application database

Patch Information

No official vendor patch is referenced in the published CVE data. Organizations operating SourceCodester Kortex Lite Advocate Office Management System 1.0 should monitor the vendor channels and consider discontinuing use until a secure release is available. Track updates via VulDB #274063.

Workarounds

• Place the application behind a WAF with SQL injection signatures enabled to block malicious id payloads
• Modify activate_act.php to validate that the id parameter is strictly numeric before use
• Refactor database access code to use prepared statements with bound parameters
• Apply the principle of least privilege to the database account used by the application

# Example WAF rule (ModSecurity) to block SQLi attempts against activate_act.php
SecRule REQUEST_URI "@contains /activate_act.php" \
    "chain,deny,status:403,id:1007642,msg:'CVE-2024-7642 SQLi attempt blocked'"
  SecRule ARGS:id "@detectSQLi" \
    "t:none,t:urlDecode,t:lowercase"