CVE-2024-8083: Online Computer And Laptop Store SQLi Flaw

CVE-2024-8083 Overview

CVE-2024-8083 is a SQL injection vulnerability in SourceCodester Online Computer and Laptop Store version 1.0, developed by oretnom23. The flaw resides in the /php-ocls/classes/Master.php?f=pay_order endpoint, where the id parameter is passed to a database query without proper sanitization. Remote attackers can manipulate this parameter to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the risk of opportunistic attacks against exposed instances. This weakness is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated remote attackers can inject SQL statements through the id parameter of the pay_order function, potentially exposing or modifying order and customer data.

Affected Products

SourceCodester Online Computer and Laptop Store 1.0
Vendor: oretnom23
Component: /php-ocls/classes/Master.php (pay_order function)

Discovery Timeline

2024-08-22 - CVE-2024-8083 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8083

Vulnerability Analysis

The vulnerability exists in the pay_order action handler within Master.php. This file serves as a central controller that dispatches requests based on the f query parameter. When f=pay_order is invoked, the handler reads the id parameter from the HTTP request and concatenates it directly into an SQL statement executed against the backend database.

Because the input is neither validated nor bound as a parameterized query variable, an attacker controls part of the SQL syntax. Exploitation requires only network access to the application and does not depend on complex preconditions. Successful injection can expose customer records, order details, and administrative account data stored in the underlying MySQL database.

Root Cause

The root cause is direct string concatenation of user-supplied input into an SQL query. The pay_order handler treats the id parameter as trusted data rather than untrusted input requiring sanitization or prepared statement binding. PHP applications using the mysqli or legacy mysql_query interfaces without parameter binding are particularly susceptible to this class of flaw.

Attack Vector

An attacker sends a crafted HTTP request to /php-ocls/classes/Master.php?f=pay_order with a malicious id value. Union-based, boolean-based, or time-based blind injection techniques all apply against the vulnerable endpoint. See the public SQL injection write-up for endpoint-specific technical details. No verified proof-of-concept code is republished here.

// No verified exploit code available - refer to the public advisory linked above

Detection Methods for CVE-2024-8083

Indicators of Compromise

HTTP requests to /php-ocls/classes/Master.php containing the f=pay_order parameter combined with SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, or -- in the id value.
Web server access logs showing repeated pay_order requests from a single source with varying id payloads.
Anomalous database errors emitted from the application (for example, syntax errors surfaced in HTTP responses) correlating with the affected endpoint.

Detection Strategies

Deploy web application firewall (WAF) signatures targeting SQL injection patterns on the pay_order action of Master.php.
Enable database query logging and alert on unexpected SELECT statements referencing sensitive tables originating from the store application account.
Correlate application-layer errors with authentication events to identify probing behavior against the ordering workflow.

Monitoring Recommendations

Monitor outbound traffic from the web server for large data transfers that may indicate exfiltration following successful injection.
Track HTTP 500 responses and application stack traces returned from the Master.php controller.
Baseline normal id parameter values (integer identifiers) and flag non-numeric or oversized payloads.

How to Mitigate CVE-2024-8083

Immediate Actions Required

Restrict network access to the Online Computer and Laptop Store application until a fix is applied, using IP allow-listing or a reverse proxy authentication layer.
Audit application and database logs for signs of prior exploitation of the pay_order handler.
Rotate database credentials and any session tokens if evidence of exploitation is found.

Patch Information

No official vendor patch has been published for this issue in the referenced advisories. Operators running SourceCodester Online Computer and Laptop Store 1.0 should track the SourceCodester project page and the VulDB entry #275564 for updates. Until a fix is available, apply the workarounds below.

Workarounds

Modify Master.php to use prepared statements with parameter binding for the id variable in the pay_order function.
Cast the id parameter to an integer using intval() before passing it to any SQL query.
Deploy a WAF rule that blocks requests to /php-ocls/classes/Master.php?f=pay_order when the id value contains non-numeric characters.
Enforce least-privilege database accounts so that the application user cannot read or modify tables outside its required scope.

bash

# Example WAF rule (ModSecurity) blocking non-numeric id values on the vulnerable endpoint
SecRule REQUEST_URI "@contains /php-ocls/classes/Master.php" \
  "chain,id:1008083,phase:2,deny,status:403,msg:'CVE-2024-8083 SQLi attempt'"
  SecRule ARGS:f "@streq pay_order" "chain"
    SecRule ARGS:id "!@rx ^[0-9]+$"