CVE-2025-0173
Published: 02 January 2025
Description
A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /orders/view_order.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Security Summary
CVE-2025-0173 is a critical SQL injection vulnerability (CWE-74, CWE-89) in SourceCodester Online Eyewear Shop 1.0, affecting unknown functionality within the /orders/view_order.php file. The issue arises from manipulation of the 'id' argument, allowing remote attackers to inject malicious SQL payloads.
The vulnerability has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating it is exploitable over the network with low complexity by users with low privileges and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption via SQL injection.
Advisories and further details are documented on VulDB (ctiid.289940, id.289940, submit.473163) and a GitHub repository at github.com/listlonely/cve/blob/main/sql.md, with the software source at sourcecodester.com. The exploit has been publicly disclosed and may be used by attackers.
The exploit disclosure increases the risk of active exploitation in unpatched instances of the affected software.
Details
- CWE(s)