Executive brief
SourceCodester Advocate Office Management System 1.0 is a web application used by legal professionals to manage case files and client information. A security flaw in the case activation feature allows unauthorized individuals to manipulate database queries. This could lead to the theft of sensitive legal data, unauthorized modification of case records, or complete takeover of the underlying server.
Technical details
A SQL injection vulnerability exists in Advocate Office Management System 1.0 within the 'id' parameter of the 'control/activate_case.php' endpoint. The application fails to sanitize user-supplied input before interpolating it into a SQL query, allowing for error-based and time-based blind injection techniques. An unauthenticated remote attacker can use this flaw to extract sensitive information from the database, such as credentials or client data. In certain configurations, this may also lead to remote code execution via stacked queries or database-level file operations. No patches are currently documented for this version.
Affected products
- SourceCodester Advocate Office Management System 1.0
Timeline
- 2026-07-29: disclosed: CVE-2025-67406 published