CVE-2025-67406 identifies a SQL Injection vulnerability in Advocate office management system 1.0, specifically in the activate_case.php file's 'id' parameter. The input is not sanitized before being used in SQL queries, allowing attackers to perform error-based and time-based blind SQL injection attacks. Payloads demonstrated include MySQL EXTRACTVALUE error-based injection and time delays via SLEEP functions, confirming the ability to infer or extract data and potentially execute arbitrary code remotely. The vulnerability is exploitable via HTTP GET requests. No patch or official remediation level has been disclosed.

An attacker can exploit this vulnerability to execute arbitrary SQL commands remotely, potentially leading to unauthorized data disclosure, data manipulation, or remote code execution within the database context. This can compromise the confidentiality, integrity, and availability of the affected system's data. The vulnerability affects the web application's backend database through the vulnerable 'id' parameter in activate_case.php.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries to mitigate SQL injection risks. Restricting direct access to the vulnerable endpoint and employing web application firewalls may also help reduce exposure.