CVE-2025-2604: Advocate Office Management System SQLi Flaw

CVE-2025-2604 Overview

CVE-2025-2604 is a SQL injection vulnerability in SourceCodester Kortex Lite Advocate Office Management System 1.0, also distributed under the Mayurik brand. The flaw resides in the edit_act.php file, where the ID parameter is passed to a database query without proper sanitization. Attackers can manipulate the parameter to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network and requires only low-privileged authentication. Public disclosure has occurred through VulDB entry #300588 and a GitHub issue, increasing the likelihood of opportunistic exploitation against exposed installations.

Critical Impact
Authenticated remote attackers can inject SQL through the ID parameter of edit_act.php, exposing case management data and enabling potential database compromise.

Affected Products

Mayurik Advocate Office Management System 1.0
SourceCodester Kortex Lite Advocate Office Management System 1.0
Deployments exposing edit_act.php to untrusted networks

Discovery Timeline

2025-03-21 - CVE-2025-2604 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2604

Vulnerability Analysis

The vulnerability is a SQL injection flaw ([CWE-89], with a parent classification of improper input neutralization [CWE-74]) in the activity edit workflow of the application. The edit_act.php script accepts an ID parameter from the HTTP request and concatenates it directly into a SQL statement. This allows an attacker to break out of the intended query context and append arbitrary SQL clauses.

Because the application is a legal case management platform, the affected database typically stores client records, matter details, and billing information. Successful exploitation can lead to unauthorized reading, modification, or deletion of these records. Attackers with database access may also pivot to authentication bypass through credential extraction or account manipulation.

The attack requires network access and low-level privileges to reach the vulnerable endpoint. No user interaction is required, and the exploit has been publicly disclosed, making automated scanning likely.

Root Cause

The root cause is direct concatenation of untrusted input into a SQL query. The edit_act.php script does not apply parameterized queries, prepared statements, or type casting to the ID argument before passing it to the MySQL/MariaDB backend. Standard input validation and output encoding controls are absent from this code path.

Attack Vector

An authenticated attacker sends a crafted HTTP request to edit_act.php with a malicious value in the ID parameter. Typical payloads use UNION-based, boolean-based, or time-based injection techniques to extract data or manipulate query logic. The attack requires no local access, no user interaction, and no elevated privileges beyond a valid application session.

The vulnerability mechanism is described in the public GitHub Issue Discussion and the VulDB #300588 Advisory. Refer to these sources for proof-of-concept payload structure.

Detection Methods for CVE-2025-2604

Indicators of Compromise

HTTP requests to edit_act.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or -- in the ID parameter
Unusually long or URL-encoded ID values in web server access logs
Database error messages returned in HTTP responses referencing MySQL/MariaDB syntax
Anomalous query volumes or long-running queries originating from the application service account

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the ID parameter of edit_act.php for SQL injection signatures
Enable database query logging and alert on queries containing tautologies such as OR 1=1 or stacked statements against the activity table
Correlate authentication events with subsequent SQL injection patterns to identify compromised accounts

Monitoring Recommendations

Forward web server and application logs to a centralized analytics platform for retention and hunting
Monitor outbound network flows from the database host for unexpected data egress
Track file integrity on edit_act.php and adjacent PHP scripts to detect tampering or webshell placement

How to Mitigate CVE-2025-2604

Immediate Actions Required

Restrict network access to the application so that only trusted users on internal networks or VPNs can reach edit_act.php
Rotate credentials for application, database, and administrative accounts after confirming the environment is clean
Review recent database activity for signs of unauthorized SELECT, UPDATE, or DELETE statements against sensitive tables

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2025-2604 at the time of publication. Operators should monitor the SourceCodester Security Resource and the VulDB #300588 Details page for updates. Until an official fix is published, apply the workarounds below and consider replacing the application if it is used to process regulated legal or client data.

Workarounds

Modify edit_act.php to use PDO or MySQLi prepared statements with bound parameters instead of string concatenation
Cast the ID parameter to an integer at the top of the script using intval() before it reaches any query
Deploy a WAF with SQL injection signatures placed in front of the application
Enforce least-privilege database accounts so the web application cannot perform schema changes or access unrelated tables

bash

# Example ModSecurity rule to block SQLi in the ID parameter of edit_act.php
SecRule REQUEST_URI "@contains /edit_act.php" \
    "phase:2,chain,deny,status:403,id:1002604,msg:'CVE-2025-2604 SQLi attempt'"
    SecRule ARGS:ID "@detectSQLi" "t:none,t:urlDecodeUni"