CVE-2024-9317: Online Eyewear Shop SQLi Vulnerability

CVE-2024-9317 Overview

CVE-2024-9317 is a SQL injection vulnerability in SourceCodester Online Eyewear Shop 1.0, developed by oretnom23. The flaw resides in the delete_category function within /classes/Master.php?f=delete_category. Attackers can manipulate the id parameter to inject arbitrary SQL statements against the backing database. The attack is exploitable remotely and requires low-privileged authentication. Public disclosure of the exploit details has occurred, increasing the likelihood of opportunistic exploitation against exposed instances.

Critical Impact
Authenticated remote attackers can inject SQL statements through the id parameter of the delete_category endpoint, resulting in unauthorized read, modification, or deletion of database records.

Affected Products

SourceCodester Online Eyewear Shop 1.0
oretnom23 online_eyewear_shop (CPE: cpe:2.3:a:oretnom23:online_eyewear_shop:1.0)
All deployments exposing /classes/Master.php?f=delete_category

Discovery Timeline

2024-09-28 - CVE-2024-9317 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9317

Vulnerability Analysis

The vulnerability is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. The delete_category function in /classes/Master.php consumes the id request parameter and concatenates it into a SQL DELETE statement without parameterization or input sanitization. Any authenticated user with access to the delete workflow can supply crafted input to alter the intended query. The attack traverses the network and requires no user interaction. Impact spans confidentiality, integrity, and availability of the underlying MySQL/MariaDB database.

Root Cause

The application concatenates user-controlled input directly into SQL statements inside delete_category. It does not use prepared statements, parameter binding, or type casting on the id argument. This design pattern is repeated across Master.php handlers in the SourceCodester codebase.

Attack Vector

An attacker submits an HTTP POST request to /classes/Master.php?f=delete_category with a malicious id payload. The payload can terminate the original DELETE statement and append additional SQL commands or time-based blind injection primitives. See the GitHub PoC Repository and VulDB entry #278821 for reproduction steps.

No verified exploit code is reproduced here. Refer to the linked references for technical proof-of-concept details.

Detection Methods for CVE-2024-9317

Indicators of Compromise

HTTP POST requests to /classes/Master.php?f=delete_category containing SQL metacharacters such as ', --, UNION, SLEEP(, or BENCHMARK( in the id parameter.
Web server access logs showing repeated requests to the delete_category endpoint from a single source IP with varying id values.
Database error messages referencing MySQL syntax errors returned in HTTP responses from the eyewear shop application.

Detection Strategies

Deploy Web Application Firewall (WAF) signatures that flag SQL keywords in the id parameter of Master.php endpoints.
Instrument the PHP application with query logging to identify malformed DELETE FROM categories statements.
Correlate authentication events with subsequent access to /classes/Master.php?f=delete_category to detect abuse of legitimate accounts.

Monitoring Recommendations

Forward web server and database logs to a central SIEM and alert on SQL error patterns tied to the vulnerable endpoint.
Baseline normal delete_category invocation volumes per user and alert on statistical deviations.
Monitor outbound database connections and file writes from the web host for signs of successful data exfiltration.

How to Mitigate CVE-2024-9317

Immediate Actions Required

Restrict network access to the Online Eyewear Shop administrative interface using IP allowlists or VPN gateways.
Rotate database credentials used by the application and enforce least-privilege grants on the categories table.
Review web and database logs for the indicators listed above and preserve evidence if compromise is suspected.

Patch Information

No official vendor patch is listed in NVD or on the SourceCodester project site at the time of the last modification date. Operators should treat the application as end-of-support and plan migration to a maintained e-commerce platform. If the codebase must remain in production, apply source-level fixes by replacing string concatenation in delete_category with a parameterized query using PDO or mysqli_prepare.

Workarounds

Disable or remove the delete_category handler in /classes/Master.php if category deletion is not required by business workflows.
Add server-side input validation to enforce that the id parameter is a positive integer before it reaches any SQL statement.
Place the application behind a WAF configured with OWASP Core Rule Set SQL injection rules in blocking mode.

bash

# Example nginx rule to reject non-numeric id values on the vulnerable endpoint
location = /classes/Master.php {
    if ($arg_f = "delete_category") {
        if ($request_body !~* "^id=[0-9]+$") { return 403; }
    }
}