CVE-2024-9973: Online Eyewear Shop SQLi Vulnerability

CVE-2024-9973 Overview

CVE-2024-9973 is a SQL injection vulnerability [CWE-89] in SourceCodester Online Eyewear Shop 1.0. The flaw resides in the Report Viewing Page accessible through /admin/?page=reports. Attackers can manipulate the date parameter to inject arbitrary SQL statements into backend queries. The vulnerability is remotely exploitable and requires only low-privileged access to the admin reports module. A public exploit has been disclosed, increasing the likelihood of opportunistic attacks against unpatched deployments.

Critical Impact

Authenticated attackers can inject SQL through the date parameter on the admin reports page, exposing or modifying database contents in the Online Eyewear Shop application.

Affected Products

• SourceCodester Online Eyewear Shop 1.0
• oretnom23 online_eyewear_shop package
• Deployments exposing /admin/?page=reports

Discovery Timeline

• 2024-10-15 - CVE-2024-9973 published to the National Vulnerability Database
• 2024-10-15 - Last updated in the NVD database

Technical Details for CVE-2024-9973

Vulnerability Analysis

The vulnerability affects the administrative Report Viewing Page of SourceCodester Online Eyewear Shop 1.0. The endpoint /admin/?page=reports accepts a date argument that is passed into a SQL query without proper sanitization or parameterization. An attacker with access to the admin interface can supply crafted input that breaks out of the intended query context. This enables retrieval of arbitrary database records, modification of stored data, or enumeration of schema metadata. The vulnerability falls under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. Because the application is a PHP web app backed by a relational database, common SQL injection primitives such as UNION-based extraction and time-based blind techniques apply. A proof-of-concept has been published publicly on GitHub Gist and indexed in VulDB entries 280338 and submission 423167.

Root Cause

The root cause is direct concatenation of the user-supplied date parameter into a SQL statement on the reports endpoint. The application does not use prepared statements, parameter binding, or input validation against an expected date format. Any string passed in date is interpreted as part of the SQL query.

Attack Vector

The attack vector is network-based over HTTP. An attacker authenticated to the admin panel sends a crafted GET request to /admin/?page=reports with a malicious date value. No user interaction beyond the attacker's own request is required. The vulnerability mechanism is described in the GitHub Gist PoC and the VulDB entry 280338.

Detection Methods for CVE-2024-9973

Indicators of Compromise

• HTTP requests to /admin/?page=reports containing SQL meta-characters such as single quotes, UNION SELECT, SLEEP(, or comment sequences -- and # in the date parameter.
• Web server access logs showing repeated requests to the reports endpoint with unusually long or encoded date values.
• Database error messages or 500 responses tied to the reports page in application logs.

Detection Strategies

• Inspect web application firewall logs for SQL injection signatures targeting the date query parameter on administrative paths.
• Correlate authentication events with anomalous report page activity to identify abuse of compromised admin accounts.
• Review database query logs for SELECT statements containing concatenated payloads originating from the reports module.

Monitoring Recommendations

• Enable verbose logging on the PHP application and the underlying database to capture the full SQL statements executed by the reports endpoint.
• Alert on outbound data transfers from the database host that exceed normal report-generation baselines.
• Monitor admin session activity for sequential requests probing different date payloads in short timeframes.

How to Mitigate CVE-2024-9973

Immediate Actions Required

• Restrict network access to the /admin/ path to trusted management networks or VPN users only.
• Rotate all admin credentials and review admin accounts for unauthorized additions.
• Deploy a web application firewall rule that blocks SQL injection patterns on the date parameter of the reports endpoint.

Patch Information

No vendor patch has been published by SourceCodester or oretnom23 for Online Eyewear Shop 1.0 at the time of CVE publication. Operators should monitor the SourceCodester project page for updates and consider applying source-level fixes that replace string concatenation with parameterized queries using PDO or mysqli prepared statements.

Workarounds

• Modify the reports module to validate that the date parameter matches a strict YYYY-MM-DD regular expression before use.
• Replace inline SQL with parameterized queries using PDO prepared statements bound to typed values.
• Apply least-privilege database accounts so that the web application user cannot read or modify tables outside its required scope.

# Example WAF rule (ModSecurity) to block SQLi patterns on the reports date parameter
SecRule REQUEST_URI "@beginsWith /admin/?page=reports" \
    "chain,phase:2,deny,status:403,id:1009973,msg:'CVE-2024-9973 SQLi attempt'"
    SecRule ARGS:date "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\(|benchmark\(|--|#|';)" "t:none"