CVE-2025-67406

https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code (remote). The component is: control/activate_case.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activate_case.php in parameter id endpoint of Advocate office management system. Unsanitized user input in the specified parameter is interpolated directly into an SQL query, allowing attackers to infer or extract data and, in some cases, execute stacked/time-based payloads. ¶¶ Affected Component & Parameter Affected Endpoint URL: http://localhost/advocate/kortex_lite/control/activate_case.php?id=1 HTTP Method: GET Vulnerable File: activate_case.php Parameter: id Vector Location: GET Injection Techniques (as identified by sqlmap) Type: error-based Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) Payload: id=1 AND EXTRACTVALUE(6268,CONCAT(0x5c,0x71766b6a71,(SELECT (ELT(6268=6268,1))),0x716a7a6b71)) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1 AND (SELECT 4464 FROM (SELECT(SLEEP(5)))aHqo) Proof of Concept (Burp Repeater)

• CWE-89

• https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/advocate/20250811-advocate-office-management-system-activate_case.php-id-sqli/20250811-advocate-office-management-system-activate_case.php-id-sqli.md
• https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/advocate/20250811-advocate-office-management-system-activate_case.php-id-sqli/20250811-advocate-office-management-system-activate_case.php-id-sqli.md

Published

Jul 29, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67397An issue in Passy v.1.6.3 allows a remote authenticated atta…9.1
• CVE-2025-67399An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 …4.6
• CVE-2025-6740The Contact Form 7 Database Addon plugin for WordPress is vu…6.1
• CVE-2025-67403Sourcecodester CASAP Automated Enrollment System 1.0 is vuln…9.8
• CVE-2025-67404Sourcecodester CASAP Automated Enrollment System 1.0 is vuln…9.8
• CVE-2025-67405Sourcecodester CASAP Automated Enrollment System 1.0 is vuln…7.3
• CVE-2025-67407Sourcecodester CASAP Automated Enrollment System 1.0 is vuln…7.3
• CVE-2025-67408Sourcecodester CASAP Automated Enrollment System 1.0 is vuln…7.3
• CVE-2025-6741Improper access control in secure message component in Devol…7.7
• CVE-2025-67418ClipBucket 5.5.2 is affected by an improper access control i…9.8
• CVE-2025-67419A Denial of Service (DoS) vulnerability in evershop 2.1.0 an…7.5
• CVE-2025-6742The SureForms – Drag and Drop Form Builder for WordPress plu…7.5