CVE-2025-3018: Online Eyewear Shop SQL Injection Flaw

CVE-2025-3018 Overview

CVE-2025-3018 is a SQL injection vulnerability in SourceCodester Online Eyewear Shop 1.0, developed by oretnom23. The flaw resides in an unknown function within the /classes/Users.php?f=delete endpoint. Attackers can manipulate the ID parameter to inject arbitrary SQL statements against the backing database. The vulnerability is exploitable remotely over the network and requires only low-privileged authentication. Public disclosure of the exploit details has occurred through VulDB and a GitHub advisory, increasing the risk of opportunistic abuse against exposed deployments.

Critical Impact

Remote attackers with low privileges can inject SQL commands through the ID parameter of the user deletion endpoint, potentially compromising the confidentiality and integrity of the application database.

Affected Products

• SourceCodester Online Eyewear Shop 1.0
• oretnom23 online_eyewear_shop 1.0
• Deployments using the /classes/Users.php user management component

Discovery Timeline

• 2025-03-31 - CVE-2025-3018 published to NVD
• 2025-04-07 - Last updated in NVD database

Technical Details for CVE-2025-3018

Vulnerability Analysis

The vulnerability is classified under [CWE-89] SQL Injection and [CWE-74] Improper Neutralization of Special Elements in Output. It affects the user deletion handler in /classes/Users.php when invoked with the f=delete action. The application concatenates the user-supplied ID argument directly into a SQL statement without parameterization or input sanitization. An authenticated attacker can supply crafted SQL syntax through this parameter to alter the executed query. Because the endpoint is reachable over HTTP, exploitation requires no local access or user interaction beyond a valid low-privileged session.

Root Cause

The root cause is the absence of prepared statements or parameter binding when handling the ID argument in the delete operation. Input passed from the HTTP request flows directly into the SQL query string. PHP applications written against MySQLi or PDO normally mitigate this by binding parameters, but the affected handler concatenates the value verbatim. This pattern matches the canonical SQL injection sink described in CWE-89.

Attack Vector

An attacker submits a crafted request to /classes/Users.php?f=delete with a malicious payload in the ID parameter. Because the endpoint executes a DELETE statement, injection payloads can be structured to extend the WHERE clause, append UNION-based queries, or trigger boolean and time-based blind extraction. Successful exploitation enables data exfiltration, deletion of arbitrary records, or modification of administrative data depending on database privileges granted to the application user. The exploit has been disclosed publicly, lowering the barrier to weaponization.

No verified proof-of-concept code is reproduced here. Technical details are documented in the GitHub CVE Documentation and VulDB entry #302070.

Detection Methods for CVE-2025-3018

Indicators of Compromise

• HTTP requests to /classes/Users.php?f=delete containing SQL metacharacters such as ', ", --, UNION, SLEEP(, or OR 1=1 in the ID parameter
• Web server access logs showing repeated delete requests with numeric ID values interleaved with non-numeric payloads
• Unexpected DELETE or SELECT statements in MySQL general or slow query logs originating from the application database user
• Application errors or HTTP 500 responses correlated with malformed ID parameter values

Detection Strategies

• Deploy web application firewall signatures that inspect query string and POST parameters bound to Users.php for SQL injection patterns
• Enable MySQL query logging and alert on DELETE statements referencing unexpected table joins or subqueries from the application service account
• Correlate authentication events with subsequent abnormal delete requests to detect abuse from compromised low-privilege accounts

Monitoring Recommendations

• Monitor outbound database traffic for anomalous SELECT volumes that may indicate UNION-based data extraction
• Track HTTP response time variance on the delete endpoint to identify time-based blind SQL injection attempts
• Review application logs for failed login attempts followed by successful sessions that immediately invoke administrative endpoints

How to Mitigate CVE-2025-3018

Immediate Actions Required

• Restrict network access to the Online Eyewear Shop administrative interface using IP allowlisting or VPN-only access
• Apply a web application firewall rule that rejects non-integer values in the ID parameter of /classes/Users.php
• Audit the application database account and revoke unnecessary privileges such as FILE, DROP, or cross-database access
• Review recent web and database logs for evidence of exploitation against the f=delete endpoint

Patch Information

No vendor patch is currently listed in the available references for CVE-2025-3018. SourceCodester Online Eyewear Shop 1.0 remains affected. Organizations running this application should treat it as unpatched and apply compensating controls. Refer to the SourceCodester project page for any future updates.

Workarounds

• Modify the affected /classes/Users.php handler to use prepared statements with bound parameters via PDO or MySQLi for the ID value
• Cast the ID parameter to an integer using intval() before incorporating it into any SQL statement as an interim measure
• Disable or remove the user deletion endpoint if it is not required for production operations
• Place the application behind an authenticating reverse proxy to limit unauthenticated reconnaissance

# Example PHP remediation pattern using PDO prepared statements
# Replace direct concatenation in /classes/Users.php delete handler
$stmt = $pdo->prepare('DELETE FROM users WHERE id = :id');
$stmt->bindValue(':id', (int)$_GET['ID'], PDO::PARAM_INT);
$stmt->execute();