CVE-2024-5894
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Online Eyewear Shop 1.0 allows remote attackers to execute arbitrary SQL commands via the 'id' parameter in manage_product.php. Attackers can potentially steal, modify, or delete database content including customer information, orders, and administrative credentials. All deployments of this specific e-commerce software version are affected.
💻 Affected Systems
- SourceCodester Online Eyewear Shop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, administrative account takeover, and potential server compromise via SQL injection to RCE chaining.
Likely Case
Data exfiltration of customer PII, order history, and administrative credentials leading to follow-on attacks.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data.
🎯 Exploit Status
Public exploit code available on GitHub; SQL injection via GET/POST parameter manipulation is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider replacing with alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameter validation to only accept numeric values for the 'id' parameter
Modify manage_product.php to include: if(!is_numeric($_GET['id'])) { die('Invalid input'); }
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
ModSecurity rule: SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with strict input validation
- Implement database-level controls: use least privilege accounts, enable query logging
🔍 How to Verify
Check if Vulnerable:
Test with payload: manage_product.php?id=1' OR '1'='1Check Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test with same payload; should return error or no SQL execution📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests with SQL keywords in id parameter
Network Indicators:
- HTTP requests containing SQL injection patterns in GET/POST parameters
SIEM Query:
web.url:*manage_product.php* AND (web.param.id:*OR* OR web.param.id:*UNION* OR web.param.id:*SELECT*)