CVE-2024-10450

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /kortex_lite/control/edit_profile.php of the component POST Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Kortex Lite Advocate Office Management System	1.0
sourcecodester	kortex_lite_advocate_office_management_system	1.0

References

https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/Advocate-office-management-system.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.282010Permissions Required, VDB Entry
https://vuldb.com/?id.282010Third Party Advisory, VDB Entry
https://vuldb.com/?submit.432614Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product

Timeline

Published: Oct 28, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-104515.9A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak bui CVE-2024-104522.7Organization admins can delete pending invites created in an organization they are not part of.CVE-2024-104535.4The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug CVE-2024-104546.1Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel. This vulnerability occurs due to the CVE-2024-104557.5Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows attacker to disrupt service via malformed Extension Block CVE-2024-104569.8Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-CVE-2024-104576.5Multiple Server-Side Request Forgery (SSRF) vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in CVE-2024-104587.5A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects CVE-2024-104597.5An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerabilit CVE-2024-10465.4The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre CVE-2024-104605.3The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects CVE-2024-104616.1In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a downl