Exploit
CVE-2024-9809

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Published: Oct 10, 2024 / Updated: 40d ago

010
CVSS 5.3EPSS 0.05%Medium
CVE info copied to clipboard

Summary

A critical vulnerability has been identified in SourceCodester Online Eyewear Shop version 1.0. The vulnerability affects the delete_product function in the file /classes/Master.php?f=delete_product. This flaw allows for SQL injection through the manipulation of the 'id' argument. The attack can be initiated remotely and does not require user interaction.

Impact

This SQL injection vulnerability can have severe consequences. An attacker could potentially: 1. Access, modify, or delete sensitive data in the database 2. Bypass authentication mechanisms 3. Execute administrative operations on the database 4. In some cases, issue commands to the operating system The CVSS v3.1 base score is 6.5 (Medium severity), with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates: - Network accessibility (AV:N) - Low attack complexity (AC:L) - Low privileges required (PR:L) - No user interaction needed (UI:N) - High impact on confidentiality (C:H) - No impact on integrity (I:N) or availability (A:N) Despite the "Medium" severity rating, the security team should consider this a high priority due to the critical classification in the description and the potential for significant data breaches.

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

As of the latest information provided, there is no mention of an available patch. The security team should monitor for updates from SourceCodester or consider implementing custom patches or workarounds until an official fix is released.

Mitigation

Recommended mitigation strategies include: 1. Implement input validation and sanitization for the 'id' parameter in the delete_product function. 2. Use parameterized queries or prepared statements instead of concatenating user input into SQL queries. 3. Apply the principle of least privilege to database accounts used by the application. 4. Regularly audit and monitor database activities for suspicious queries. 5. Consider using a Web Application Firewall (WAF) to help detect and block SQL injection attempts. 6. If possible, temporarily disable the vulnerable function until a proper fix can be implemented. 7. Keep the SourceCodester Online Eyewear Shop software and all related components up to date with the latest security patches.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9809. See article

Oct 10, 2024 at 9:25 AM / VulDB Updates
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 10, 2024 at 9:26 AM
CVE Assignment

NVD published the first details for CVE-2024-9809

Oct 10, 2024 at 8:15 PM
CVSS

A CVSS base score of 6.3 has been assigned.

Oct 10, 2024 at 8:20 PM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.4%)

Oct 11, 2024 at 10:19 AM
CVSS

A CVSS base score of 6.5 has been assigned.

Oct 15, 2024 at 7:25 PM / nvd
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Oct 15, 2024 at 9:10 PM
Static CVE Timeline Graph

Affected Systems

Oretnom23/online_eyewear_shop
+null more

Exploits

https://github.com/wuyanzu-lab/cve/blob/main/sql.md
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

News

CVE-2024-9809 Exploit
CVE Id : CVE-2024-9809 Published Date: 2024-10-15T19:21:00+00:00 A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is the function delete_product of the file /classes/Master.php?f=delete_product. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. inTheWild added a link to an exploit: https://github.com/wuyanzu-lab/cve/blob/main/sql.md
CVE Alert: CVE-2024-9809
Affected by this vulnerability is the function delete_product of the file /classes/Master.php?f=delete_product. Affected Endpoints:
CVE-2024-9809
Gravedad 3.1 (CVSS 3.1 Base Score) A vulnerability was found in SourceCodester Online Eyewear Shop 1.0.
NA - CVE-2024-9809 - A vulnerability was found in SourceCodester...
A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is the function delete_product of the file...
CVE-2024-9809
Medium Severity Description A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is the function delete_product of the file /classes/Master.php?f=delete_product. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Read more at https://www.tenable.com/cve/CVE-2024-9809
See 7 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:None
Availability Impact:None

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI