CVE-2025-3018
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Online Eyewear Shop 1.0 allows attackers to manipulate database queries through the /classes/Users.php?f=delete endpoint. Remote attackers can potentially access, modify, or delete sensitive data in the database. All deployments of this specific e-commerce software version are affected.
💻 Affected Systems
- SourceCodester Online Eyewear Shop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including theft of customer PII, payment data, admin credentials, and potential remote code execution leading to full system takeover.
Likely Case
Data exfiltration of user information, session hijacking, privilege escalation, and potential defacement or data destruction.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions restricting unauthorized access.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Attack requires some level of access to the user deletion function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Implement parameterized queries in /classes/Users.php, validate and sanitize all user inputs, especially the ID parameter.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd strict input validation to the ID parameter in the delete function to only accept expected values
Web Application Firewall Rules
allImplement WAF rules to block SQL injection patterns targeting the /classes/Users.php endpoint
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with strict input filtering
- Implement database-level controls: restrict application database user permissions, enable logging of all database queries
🔍 How to Verify
Check if Vulnerable:
Test the /classes/Users.php?f=delete endpoint with SQL injection payloads in the ID parameterCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Verify that parameterized queries are implemented and SQL injection attempts are properly rejected📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web application, multiple failed delete attempts, SQL syntax errors in logs
Network Indicators:
- HTTP requests to /classes/Users.php with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/classes/Users.php" AND (param="ID" AND value CONTAINS "UNION" OR "SELECT" OR "--" OR "' OR '")