CVE-2024-9328: Advocate Office Management System SQLi Flaw

CVE-2024-9328 Overview

CVE-2024-9328 is a SQL injection vulnerability in SourceCodester Advocate Office Management System 1.0, developed by Mayurik. The flaw resides in the /control/edit_client.php script, where the id parameter is incorporated into a database query without proper sanitization. Remote attackers with low-privileged access can manipulate this parameter to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the risk of opportunistic attacks against exposed deployments. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Authenticated attackers can remotely inject SQL queries through the id parameter of edit_client.php, potentially exposing or modifying client records stored in the backend database.

Affected Products

• Mayurik Advocate Office Management System 1.0
• SourceCodester distribution of Advocate Office Management System
• Deployments using cpe:2.3:a:mayurik:advocate_office_management_system:1.0

Discovery Timeline

• 2024-09-29 - CVE-2024-9328 published to the National Vulnerability Database
• 2024-10-01 - Last updated in NVD database

Technical Details for CVE-2024-9328

Vulnerability Analysis

The Advocate Office Management System exposes a client management interface through /control/edit_client.php. This endpoint accepts the id parameter via HTTP request and uses it to build a SQL query that retrieves client information for editing. The application concatenates the user-supplied value directly into the query string without parameterization or input validation.

An attacker authenticated with low-level privileges can submit a crafted id value to alter the structure of the SQL query. This allows extraction of arbitrary database contents, including client records, case files, and credentials stored in adjacent tables. The flaw is reachable over the network and requires no user interaction.

Public disclosure of the exploit technique on GitHub and VulDB lowers the barrier for adversaries to weaponize the vulnerability against internet-facing deployments.

Root Cause

The root cause is the absence of prepared statements or input sanitization in the handler for the id parameter. The application trusts client-supplied input and passes it directly to the database layer. This pattern, common in PHP applications that use raw mysqli_query or equivalent calls, breaks the separation between SQL code and user data.

Attack Vector

Exploitation occurs remotely over HTTP/HTTPS. An attacker authenticated to the application sends a request to /control/edit_client.php?id=<payload>, where the payload contains SQL metacharacters such as UNION SELECT clauses or boolean-based injection probes. Successful exploitation enables data extraction, modification, and in some configurations, file write or command execution through database functionality.

The vulnerability mechanism is documented in the public proof-of-concept hosted at GitHub - Advocate Office SQL Injection Writeup and tracked at VulDB #278837.

Detection Methods for CVE-2024-9328

Indicators of Compromise

• HTTP requests to /control/edit_client.php containing SQL keywords such as UNION, SELECT, SLEEP, AND 1=1, or comment markers -- and # in the id parameter
• Web server access logs showing unusually long id parameter values or URL-encoded SQL syntax
• Database error messages returned to clients indicating syntax errors near the id value
• Spikes in database query volume or latency originating from the edit_client.php endpoint

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect query strings to edit_client.php for SQL injection signatures
• Enable verbose query logging on the backing database and correlate queries against tables such as clients with the originating HTTP session
• Monitor PHP error logs for mysqli or PDO exceptions tied to the edit_client.php handler

Monitoring Recommendations

• Alert on any authenticated user accessing edit_client.php with non-numeric id values
• Track repeated 500-series HTTP responses from the /control/ directory as a sign of injection probing
• Review authentication logs for low-privileged accounts performing unexpected client record queries

How to Mitigate CVE-2024-9328

Immediate Actions Required

• Restrict network access to the Advocate Office Management System to trusted internal networks or VPN users until a fix is applied
• Audit the clients table and related schemas for evidence of unauthorized SELECT, UPDATE, or DELETE operations
• Rotate database credentials and any secrets that may have been exposed through the affected query path
• Revoke unnecessary privileges from the database account used by the web application

Patch Information

No official vendor patch has been published at the time of this writing. Administrators should monitor SourceCodester and the Mayurik product channels for updates. In the absence of a vendor fix, organizations must apply source-level remediation by replacing string concatenation with parameterized queries in edit_client.php and validating that id is a positive integer before use.

Workarounds

• Place the application behind a WAF configured with OWASP CRS SQL injection rule sets
• Modify edit_client.php locally to cast the id parameter to an integer using intval() or PHP type hints before passing it to the database
• Apply least-privilege principles to the database user, removing FILE, CREATE, and DROP permissions
• Disable the affected module if the client edit functionality is not in active use

# Example: input validation patch for edit_client.php
# Replace direct use of $_GET['id'] with strict integer casting
$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
if ($id === false || $id === null) {
    http_response_code(400);
    exit('Invalid client identifier');
}
$stmt = $conn->prepare('SELECT * FROM clients WHERE id = ?');
$stmt->bind_param('i', $id);
$stmt->execute();