EUVD-2025-210534
GHSA-8933-qpw2-wm45
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Unauthenticated network GET parameter (AV:N/AC:L/PR:N/UI:N); error-based plus blind SQLi enables full DB read (C:H), limited write via stacked queries (I:L), no availability impact (A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code (remote). The component is: control/activate_case.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activate_case.php in parameter id endpoint of Advocate office management system. Unsanitized user input in the specified parameter is interpolated directly into an SQL query, allowing attackers to infer or extract data and, in some cases, execute stacked/time-based payloads. ¶¶ Affected Component & Parameter Affected Endpoint URL: http://localhost/advocate/kortex_lite/control/activate_case.php?id=1 HTTP Method: GET Vulnerable File: activate_case.php Parameter: id Vector Location: GET Injection Techniques (as identified by sqlmap) Type: error-based Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) Payload: id=1 AND EXTRACTVALUE(6268,CONCAT(0x5c,0x71766b6a71,(SELECT (ELT(6268=6268,1))),0x716a7a6b71)) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1 AND (SELECT 4464 FROM (SELECT(SLEEP(5)))aHqo) Proof of Concept (Burp Repeater)
AnalysisAI
SQL injection in the Advocate Office Management System 1.0 (a SourceCodester PHP application) lets remote unauthenticated attackers inject arbitrary SQL through the 'id' GET parameter of control/activate_case.php. Publicly available exploit code exists (SSVC exploitation status: poc), with confirmed error-based and time-based blind techniques enabling full database extraction; the 'remote code execution' framing in the report is not substantiated by the provided sqlmap payloads. EPSS is low (0.16%, 6th percentile) and the flaw is not on CISA KEV, so no active exploitation is confirmed.
Technical ContextAI
The affected software is Advocate Office Management System 1.0, a free PHP/MySQL case-management application distributed via SourceCodester (kortex_lite package). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the 'id' value from a GET request to activate_case.php is interpolated directly into a MySQL query without parameterization or sanitization. The reported sqlmap fingerprints confirm two working classes: EXTRACTVALUE-based error injection (MySQL >= 5.1) and query-SLEEP time-based blind injection (MySQL >= 5.0.12), both operating inside a WHERE/HAVING/ORDER BY clause. The CPE string (cpe:2.3:a:n/a:n/a:*) is a placeholder with no real vendor/product mapping, so exact product identification relies on the description rather than NVD CPE data.
RemediationAI
No vendor-released patch identified at time of analysis - SourceCodester demo projects are rarely formally maintained, so assume no upstream fix. The definitive code-level fix is to rewrite the activate_case.php query using parameterized/prepared statements (PDO or mysqli bound parameters) and to cast 'id' to an integer before use; apply the same pattern across all other control/*.php endpoints, as SourceCodester apps commonly share the flaw. As compensating controls until code is fixed: restrict access to the /control/ path to authenticated administrators (this app is intended for internal office use, so exposing it to the internet is the core exposure - remove public reachability); deploy a WAF rule blocking SQL metacharacters and known sqlmap signatures on the 'id' parameter (trade-off: bypassable and may break legitimate numeric-only IDs if tuned too loosely); and enforce least-privilege on the MySQL account so it cannot run stacked/DDL statements (limits any data modification but not read-based extraction). Track the reference report at https://github.com/um-dsp/TaintRadar and VulDB https://vuldb.com/vuln/384299 for any fix updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today