CVE-2025-2651: Online Eyewear Shop Information Disclosure

CVE-2025-2651 Overview

CVE-2025-2651 is an information disclosure vulnerability in SourceCodester Online Eyewear Shop 1.0. The flaw resides in the /oews/admin/ path and its sub-directories. The web server exposes directory listings to unauthenticated remote users, allowing attackers to enumerate files and folders that should not be publicly browsable. The vulnerability maps to [CWE-548] Exposure of Information Through Directory Listing and [CWE-552] Files or Directories Accessible to External Parties. Public disclosure of the exploit technique makes opportunistic exploitation likely. Attackers can gather sensitive filenames, source paths, and configuration references that support further attacks against the application.

Critical Impact
Remote unauthenticated attackers can enumerate administrative directories of the Online Eyewear Shop, exposing filenames and paths that facilitate follow-on attacks.

Affected Products

SourceCodester Online Eyewear Shop 1.0
oretnom23:online_eyewear_shop 1.0
Multiple sub-directories under /oews/admin/

Discovery Timeline

2025-03-23 - CVE-2025-2651 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2651

Vulnerability Analysis

The web server hosting the Online Eyewear Shop application serves directory indexes for the /oews/admin/ path and its sub-directories. When no default index file is present, the server responds with an auto-generated HTML listing of every file and folder in the requested directory. Attackers use these listings to map the application, identify backup files, locate configuration artifacts, and discover source files intended for internal use only. The vulnerability requires no authentication and no user interaction, and it is reachable over the network. Because directory listings frequently reveal file names such as database dumps, upload folders, or included PHP scripts, the disclosure can chain into more serious attacks including credential recovery or targeted file inclusion.

Root Cause

The root cause is an insecure default web server configuration that leaves directory browsing enabled and omits index files from administrative sub-directories. The application ships without an .htaccess directive or equivalent server-side rule to disable Options +Indexes. Any directory lacking an index.php or index.html file is therefore rendered as a browsable listing.

Attack Vector

An unauthenticated attacker issues an HTTP GET request to /oews/admin/ or any affected sub-directory. The server responds with an HTML index enumerating all files in that directory. The attacker parses the listing, requests individual files of interest, and repeats the process across sub-directories. The technique requires only a web browser or a command-line HTTP client. No exploitation code is required beyond standard HTTP requests. See the GitHub CVE Vulnerability Documentation and VulDB entry #300666 for reproduction details.

Detection Methods for CVE-2025-2651

Indicators of Compromise

HTTP GET requests to /oews/admin/ and sub-directories that return 200 OK responses with Content-Type: text/html and body markers such as Index of /.
Repeated sequential requests from a single source enumerating multiple administrative sub-directories within a short time window.
User-Agent strings associated with directory brute-force tools such as dirb, gobuster, or feroxbuster targeting the /oews/ path.

Detection Strategies

Inspect web server access logs for responses containing the string Index of in the response body when the request path targets /oews/admin/.
Configure the web application firewall to alert on responses to administrative paths that exceed a size threshold consistent with generated directory listings.
Run authenticated web vulnerability scans against staging environments to identify any directory that returns an auto-generated index.

Monitoring Recommendations

Ingest web server access logs into a centralized analytics platform and alert on bursts of 2xx responses for administrative directory paths.
Baseline normal request patterns to /oews/admin/ and flag anomalous enumeration behavior from unauthenticated clients.
Monitor outbound access to any sensitive files discovered through directory listings, particularly database backups and configuration files.

How to Mitigate CVE-2025-2651

Immediate Actions Required

Disable directory browsing at the web server level for the entire Online Eyewear Shop document root and all sub-directories.
Place an empty index.html or valid index.php file in every administrative sub-directory as a defense-in-depth measure.
Restrict access to /oews/admin/ to authenticated administrators through server-side authentication controls.
Review any files exposed by prior directory listings and rotate credentials or secrets that may have leaked.

Patch Information

No vendor patch is currently listed in the NVD entry for CVE-2025-2651. The advisory recommends changing the web server configuration to disable directory indexing. Consult the VulDB advisory and the SourceCodester project page for further updates.

Workarounds

On Apache, add Options -Indexes to the site configuration or an .htaccess file in the application root.
On Nginx, ensure the autoindex directive is set to off in all relevant location blocks.
Deploy a reverse proxy or WAF rule that blocks any response body containing the Index of marker for administrative paths.

bash

# Configuration example
# Apache .htaccess placed in /oews/admin/
Options -Indexes

# Nginx server block
location /oews/ {
    autoindex off;
}