CVE-2024-9905: Online Eyewear Shop SQLi Vulnerability

CVE-2024-9905 Overview

CVE-2024-9905 is a SQL injection vulnerability in SourceCodester Online Eyewear Shop 1.0. The flaw exists in the /admin/?page=inventory/view_inventory&id=2 endpoint, where the id parameter is passed directly into a database query without proper sanitization. An authenticated attacker with low privileges can manipulate the id argument to inject arbitrary SQL statements. The exploit has been publicly disclosed and can be triggered remotely over the network. The weakness is tracked under CWE-89.

Critical Impact
Attackers can read, modify, or delete inventory data and potentially extract administrator credentials from the backend database.

Affected Products

Oretnom23 Online Eyewear Shop 1.0
SourceCodester Online Eyewear Shop (all builds derived from 1.0)
Deployments using the inventory/view_inventory admin module

Discovery Timeline

2024-10-13 - CVE-2024-9905 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9905

Vulnerability Analysis

The vulnerability resides in the administrative inventory view of Online Eyewear Shop 1.0. The application constructs SQL queries by concatenating the user-supplied id GET parameter directly into the query string. Because the parameter is not validated, escaped, or bound as a prepared statement value, an attacker can append additional SQL syntax such as UNION SELECT payloads or boolean-based conditions.

Exploitation requires an authenticated session with at least low privileges, but the attack complexity is low and no user interaction is required. Successful injection allows reading arbitrary tables, extracting password hashes, and altering inventory records. Publicly available proof-of-concept details are hosted on a GitHub Gist referenced by the vendor advisory.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The view_inventory handler concatenates the id request parameter into a query without parameterized binding or type casting to an integer. Any string supplied through the id argument is executed as part of the query context.

Attack Vector

The attack is initiated remotely over HTTP against the /admin/?page=inventory/view_inventory&id= endpoint. An attacker submits a crafted id value containing SQL metacharacters. Because the endpoint is reachable to any authenticated admin-panel user, credential compromise or weak default accounts amplify exposure. Additional technical details are cataloged in the VulDB entry #280181.

No verified exploit code has been packaged in ExploitDB. The vulnerability is described in prose in the public disclosure, and no sanitized payloads are reproduced here.

Detection Methods for CVE-2024-9905

Indicators of Compromise

HTTP requests to /admin/?page=inventory/view_inventory where the id parameter contains SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment sequences like -- and #.
Web server access logs showing repeated requests with incrementing or malformed id values from a single source IP.
Unexpected database errors or long-running queries originating from the eyewear shop application user.
New or modified administrator accounts in the users table without a corresponding administrative workflow.

Detection Strategies

Deploy a web application firewall (WAF) rule set that inspects the id query-string parameter for SQL injection signatures.
Enable verbose query logging on the backing MySQL/MariaDB instance and alert on syntax errors tied to the application account.
Correlate admin-panel authentication events with subsequent anomalous request bursts targeting inventory endpoints.

Monitoring Recommendations

Baseline normal view_inventory request patterns and flag deviations in payload length or character composition.
Monitor outbound database traffic for unusually large result sets that could indicate data exfiltration through UNION-based extraction.
Track failed and successful admin logins to identify brute-force precursors that enable authenticated exploitation.

How to Mitigate CVE-2024-9905

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlisting or VPN-only reachability until a patched build is available.
Rotate all administrator credentials and disable default or shared accounts on the Online Eyewear Shop installation.
Deploy WAF signatures that block SQL injection payloads targeting the id parameter on the inventory view route.
Audit the application database for unauthorized rows, modified inventory entries, and unexpected privilege changes.

Patch Information

No official vendor patch has been published by SourceCodester or oretnom23 for CVE-2024-9905 at the time of NVD publication. Operators should track the SourceCodester project page for updates and consider forking the application to apply parameterized queries in the view_inventory handler.

Workarounds

Modify the view_inventory module to cast $_GET['id'] to an integer using intval() before it is used in any SQL statement.
Replace inline query construction with prepared statements using PDO or MySQLi with bound parameters.
Enforce least-privilege database credentials so the application account cannot read sensitive tables such as users or admin.
Place the admin interface behind an authenticating reverse proxy that adds an additional authentication layer.

bash

# Example WAF rule fragment (ModSecurity) blocking SQLi on the id parameter
SecRule ARGS:id "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|#|;)" \
    "id:1009905,phase:2,deny,status:403,\
    msg:'CVE-2024-9905 SQLi attempt on view_inventory id parameter'"