Exploit
CVE-2024-9082

Improper Authorization (CWE-285)

Published: Sep 22, 2024 / Updated: 58d ago

010
CVSS 5.3EPSS 0.05%Medium
CVE info copied to clipboard

Summary

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Users.phpf=save of the component User Creation Handler. The manipulation of the argument type with the input 1 leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Impact

This vulnerability allows remote attackers to bypass authorization controls, potentially leading to unauthorized access to sensitive functionality or data. Given the critical rating and the CVSS v3.1 base score of 9.8, the impact is severe. Attackers could potentially gain full control over the affected system, compromising the confidentiality, integrity, and availability of data and services. This could result in unauthorized user account creation, modification of existing accounts, or access to privileged functions within the Online Eyewear Shop application.

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability details have been published on vuldb.com, and patch information can be found at the following URLs: 1. https://vuldb.com/?ctiid.278252 2. https://vuldb.com/?id.278252 3. https://vuldb.com/?submit.411565

Mitigation

1. Apply the available patch immediately to SourceCodester Online Eyewear Shop version 1.0. 2. Implement proper authorization checks in the User Creation Handler, especially in the /Users.phpf=save file. 3. Validate and sanitize all user inputs, particularly those related to user type arguments. 4. Implement the principle of least privilege for all user accounts and system components. 5. Monitor for any suspicious activities or unauthorized access attempts, especially those targeting the User Creation Handler. 6. Consider implementing additional access controls and authentication mechanisms to protect sensitive functionality. 7. Regularly review and update security configurations for the web application and its underlying systems. 8. Conduct a thorough security audit of the entire application to identify and address any similar vulnerabilities.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9082. See article

Sep 22, 2024 at 8:04 AM / CVE
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 22, 2024 at 8:04 AM
CVE Assignment

NVD published the first details for CVE-2024-9082

Sep 22, 2024 at 8:15 AM
CVSS

A CVSS base score of 6.3 has been assigned.

Sep 22, 2024 at 8:20 AM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.3%)

Sep 23, 2024 at 10:47 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Sep 27, 2024 at 4:20 PM / nvd
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Sep 27, 2024 at 7:12 PM
Static CVE Timeline Graph

Affected Systems

Oretnom23/online_eyewear_shop
+null more

Exploits

https://github.com/41lai/cve/blob/main/add.md
+null more

Patches

vuldb.com
+null more

Links to Mitre Att&cks

T1574.010: Services File Permissions Weakness
+null more

Attack Patterns

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
+null more

News

CVE-2024-9082 Exploit
CVE Id : CVE-2024-9082 Published Date: 2024-09-27T16:18:00+00:00 A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Users.phpf=save of the component User Creation Handler. The manipulation of the argument type with the input 1 leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. inTheWild added a link to an exploit: https://github.com/41lai/cve/blob/main/add.md
CVE Alert: CVE-2024-9082 - https://www.redpacketsecurity.com/cve_alert_cve-2024-9082/ #OSINT #ThreatIntel #CyberSecurity #cve_2024_9082
CVE Alert: CVE-2024-9082 - redpacketsecurity.com/cve_al… #OSINT #ThreatIntel #CyberSecurity #cve_2024_9082
CVE Alert: CVE-2024-9082 - https://www. redpacketsecurity.com/cve_aler t_cve-2024-9082/ # OSINT # ThreatIntel # CyberSecurity # cve_2024_9082
CVE-2024-9082
Medium Severity Description A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Users.phpf=save of the component User Creation Handler. The manipulation of the argument type with the input 1 leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Read more at https://www.tenable.com/cve/CVE-2024-9082
CVE-2024-9082
Gravedad 3.1 (CVSS 3.1 Base Score) Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
See 9 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI