Exploit
CVE-2024-9317

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Published: Sep 28, 2024 / Updated: 52d ago

010
CVSS 5.3EPSS 0.05%Medium
CVE info copied to clipboard

Summary

A critical vulnerability has been discovered in SourceCodester Online Eyewear Shop version 1.0. The vulnerability affects the delete_category function in the file /classes/Master.php?f=delete_category. This vulnerability allows for SQL injection through the manipulation of the 'id' argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Impact

This SQL injection vulnerability can have severe consequences. An attacker could potentially: 1. Access, modify, or delete sensitive data in the database. 2. Bypass authentication mechanisms. 3. Execute administrative operations on the database. 4. In some cases, issue commands to the operating system. Given the CVSS v3.1 base score of 8.8 (High), this vulnerability has high impact on confidentiality, integrity, and availability of the system.

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

As of the current information, there is no mention of an available patch for this vulnerability in SourceCodester Online Eyewear Shop 1.0.

Mitigation

While no specific patch is mentioned, the following mitigation strategies are recommended: 1. Update the SourceCodester Online Eyewear Shop to a version newer than 1.0 if available. 2. Implement input validation and parameterized queries in the delete_category function to prevent SQL injection. 3. Apply the principle of least privilege to database accounts used by the application. 4. Regularly monitor and audit database activities for any suspicious operations. 5. Consider using a Web Application Firewall (WAF) to help detect and block SQL injection attempts. 6. If possible, temporarily disable the vulnerable function until a proper fix can be applied.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9317. See article

Sep 28, 2024 at 7:34 AM / VulDB Updates
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 28, 2024 at 7:34 AM
CVE Assignment

NVD published the first details for CVE-2024-9317

Sep 28, 2024 at 9:15 PM
CVSS

A CVSS base score of 6.3 has been assigned.

Sep 28, 2024 at 9:20 PM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.3%)

Sep 29, 2024 at 12:11 PM
CVSS

A CVSS base score of 8.8 has been assigned.

Oct 1, 2024 at 1:35 PM / nvd
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Oct 1, 2024 at 9:11 PM
Static CVE Timeline Graph

Affected Systems

Oretnom23/online_eyewear_shop
+null more

Exploits

https://github.com/o0wll/cve/blob/main/sql.md
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

News

Security Bulletin 02 Oct 2024 - Cyber Security Agency of Singapore
This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing ...
CVE-2024-9317 Exploit
CVE Id : CVE-2024-9317 Published Date: 2024-10-01T13:32:00+00:00 A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function delete_category of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. inTheWild added a link to an exploit: https://github.com/o0wll/cve/blob/main/sql.md
CVE-2024-9317
High Severity Description A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function delete_category of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Read more at https://www.tenable.com/cve/CVE-2024-9317
Update Sun Sep 29 06:28:03 UTC 2024
Update Sun Sep 29 06:28:03 UTC 2024
CVE-2024-9317
Gravedad 3.1 (CVSS 3.1 Base Score) A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0.
See 7 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI