CVE-2024-9082
📋 TL;DR
This vulnerability in SourceCodester Online Eyewear Shop 1.0 allows attackers to bypass authorization controls during user creation. By manipulating the 'Type' parameter with input '1', attackers can create unauthorized user accounts with elevated privileges. This affects all deployments of the vulnerable software version.
💻 Affected Systems
- SourceCodester Online Eyewear Shop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers create administrative accounts, gaining full control over the application to steal data, modify content, or deploy additional malware.
Likely Case
Attackers create regular user accounts to access restricted functionality, potentially leading to data theft or privilege escalation.
If Mitigated
With proper network segmentation and monitoring, impact is limited to the application layer with no lateral movement.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily weaponizable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates or consider alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to reject unauthorized 'Type' parameter values
Modify /classes/Users.php to validate 'Type' parameter before processing
Access Control Restriction
allRestrict access to /classes/Users.php endpoint to authorized users only
Add authentication check at beginning of Users.php file
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests with suspicious 'Type' parameter values
- Monitor user creation logs for unauthorized account creation attempts
🔍 How to Verify
Check if Vulnerable:
Test if sending POST request to /classes/Users.php?f=save with Type=1 creates unauthorized userCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Verify that Type parameter validation rejects unauthorized values and requires proper authentication📡 Detection & Monitoring
Log Indicators:
- Multiple user creation attempts with Type=1 parameter
- User creation from unexpected IP addresses
Network Indicators:
- POST requests to /classes/Users.php?f=save with Type=1 parameter
SIEM Query:
web_access_logs WHERE url_path CONTAINS '/classes/Users.php' AND parameters CONTAINS 'Type=1'