CVE-2024-9974
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary SQL commands via the product_id parameter in the add_to_card functionality of SourceCodester Online Eyewear Shop 1.0. Attackers can potentially read, modify, or delete database content. All deployments of version 1.0 are affected.
💻 Affected Systems
- SourceCodester Online Eyewear Shop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential remote code execution if database permissions allow.
Likely Case
Data exfiltration of sensitive information (user credentials, payment data, personal information) and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
Public exploit code is available. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Parameterized Queries
allImplement proper input validation and use prepared statements/parameterized queries for all database operations.
Modify classes/Master.php to use prepared statements for the add_to_card function
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests.
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with SQL injection filtering
- Implement strict network segmentation and limit access to the application
🔍 How to Verify
Check if Vulnerable:
Test the /classes/Master.php?f=add_to_card endpoint with SQL injection payloads in the product_id parameter.Check Version:
Check the application version in the admin panel or configuration files.Verify Fix Applied:
Verify that SQL injection payloads no longer execute and return appropriate error messages.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple POST requests to /classes/Master.php with suspicious parameters
Network Indicators:
- SQL keywords in POST request parameters
- Unusual database query patterns
SIEM Query:
source="web_logs" AND uri="/classes/Master.php" AND (param="product_id" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|--|#|\*|;)")