sql injection vulnerabilities in Best Free Law Office Management Software（addcase_stage.php）

sql injection vulnerabilities in Best Free Law Office Management Software
Explaination:
SQL injection errors occur when:
Data enters a program from an untrusted source.
The data is used to dynamically construct a SQL query.
 
Target Code source:
https://www.mayurik.com/source-code/P5339/best-free-law-office-management-software

Url:  /kortex_lite/control/addcase_stage.php

Abstract:

The SQL statement executed in 49 lines of code is composed of external input collages.  Due to the lack of filtering or prepared statemnets，attackers can achieve SQL injection by constructing statements through unvalidated input.

Details:

In this case the data is passed to exec() in addcase_stage.php at line49.

The interface could be found in"case stage"

 sqlmap.py -r sql_test1.txt

sqlmap.py -r sql_test1.txt --current-db