CVE-2024-8949: Online Eyewear Shop Auth Bypass Flaw

CVE-2024-8949 Overview

CVE-2024-8949 is a broken access control vulnerability in SourceCodester Online Eyewear Shop 1.0. The flaw resides in the /classes/Master.php file, specifically within the Cart Content Handler component. Attackers manipulate the cart_id or id argument to access or modify cart entries belonging to other users. The weakness maps to CWE-282: Improper Ownership Management. The exploit has been publicly disclosed, and the attack can be executed remotely over the network with only low-level authentication.

Critical Impact
Remote authenticated attackers can tamper with cart records belonging to other shoppers, leading to unauthorized modification of order data and violation of user ownership boundaries.

Affected Products

SourceCodester Online Eyewear Shop 1.0
oretnom23:online_eyewear_shop (CPE: cpe:2.3:a:oretnom23:online_eyewear_shop:1.0)
Cart Content Handler component in /classes/Master.php

Discovery Timeline

2024-09-17 - CVE-2024-8949 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-8949

Vulnerability Analysis

The vulnerability exists in the Cart Content Handler routines implemented in /classes/Master.php. The handler accepts a cart_id or id parameter from client requests but fails to verify that the supplied identifier belongs to the currently authenticated user. This missing ownership check allows a low-privileged, authenticated user to reference arbitrary cart entries across account boundaries. The attack requires no user interaction and can be launched remotely against any reachable installation. Public disclosure of the exploit increases the likelihood of opportunistic abuse against unpatched deployments.

Root Cause

The root cause is improper ownership management [CWE-282]. Server-side code trusts the client-supplied cart_id/id value and performs database operations without validating that the record is associated with the requesting session. The application enforces authentication but not authorization at the object level, resulting in an Insecure Direct Object Reference (IDOR) pattern.

Attack Vector

The attack is delivered over the network against the vulnerable PHP endpoint. An authenticated attacker submits crafted HTTP POST requests to actions handled by Master.php and substitutes another user's cart identifier for their own. Because the handler does not compare the record owner to the session user, the request completes and mutates or reveals the targeted cart's contents. See the GitHub CVE Analysis and VulDB entry #277767 for reproduction notes.

No verified proof-of-concept code has been published in a form suitable for inclusion. The vulnerability manifests when a request to Master.php supplies a cart_id or id value the current session does not own, and the handler processes the record without an ownership check.

Detection Methods for CVE-2024-8949

Indicators of Compromise

HTTP POST requests to /classes/Master.php containing cart_id or id parameters that reference records not tied to the authenticated session user.
Sudden bursts of cart modification or retrieval actions from a single account against sequential numeric identifiers.
Application log entries showing successful cart operations where the session user ID does not match the cart owner ID stored in the database.

Detection Strategies

Instrument the application to log the session user ID alongside every cart_id/id accessed in Master.php, then alert on mismatches.
Deploy a web application firewall (WAF) rule that flags parameter tampering patterns such as rapid enumeration of numeric cart identifiers.
Correlate database query logs with authenticated session context to identify cross-account data access.

Monitoring Recommendations

Monitor HTTP traffic to /classes/Master.php for anomalous parameter values and unauthenticated-to-authenticated privilege transitions.
Track EPSS movement for CVE-2024-8949 (currently ~0.72%) to gauge exploitation likelihood over time.
Review web server access logs for referrer and User-Agent anomalies tied to cart endpoints.

How to Mitigate CVE-2024-8949

Immediate Actions Required

Restrict access to the Online Eyewear Shop application to trusted networks until a vendor fix is available.
Add server-side authorization checks in /classes/Master.php that verify the session user owns the requested cart_id before processing.
Audit existing cart records for signs of cross-account modification following public disclosure.

Patch Information

No official vendor patch has been published for SourceCodester Online Eyewear Shop 1.0 at the time of NVD publication. Operators should apply custom code fixes that enforce ownership validation and monitor the SourceCodester project page for updates. Refer to the VulDB submission #409459 for additional context.

Workarounds

Implement a server-side check that compares the session user ID with the user_id column of the cart record before any read, update, or delete operation.
Replace direct numeric cart_id references with indirect, per-session mappings to prevent identifier enumeration.
Place the application behind an authenticated reverse proxy or WAF ruleset that blocks requests where the parameter payload references identifiers outside a per-user allowlist.

bash

# Example server-side ownership check to enforce before cart operations
# (illustrative pseudocode for /classes/Master.php)
$stmt = $conn->prepare("SELECT user_id FROM cart WHERE id = ?");
$stmt->bind_param("i", $_POST['cart_id']);
$stmt->execute();
$row = $stmt->get_result()->fetch_assoc();
if (!$row || $row['user_id'] !== $_SESSION['user_id']) {
    http_response_code(403);
    exit('Forbidden');
}