SourceCodester Online Eyewear Shop Inventory Page Master.php cross site scripting

The XSS vulnerability in Online Eyewear Shop allows an attacker to inject malicious JavaScript code into the application. This code can then be executed in the context of a user's browser when they visit the affected page. An attacker could leverage this to steal session cookies, redirect users to phishing sites, or deface the website. The impact is amplified if the application handles sensitive user data, such as payment information or personal details, as the attacker could potentially intercept this data. The remote nature of the vulnerability means an attacker doesn't need to be authenticated to exploit it, significantly broadening the potential attack surface. Similar XSS vulnerabilities in other e-commerce platforms have been used to deploy malware and steal user credentials.

Small to medium-sized businesses utilizing Online Eyewear Shop for their online retail operations are particularly at risk. Shared hosting environments where multiple websites share the same server infrastructure are also vulnerable, as a compromise of one website could potentially lead to the compromise of others. Users relying on legacy configurations or outdated security practices are also more susceptible.

• php / web:

curl -s -X POST -d "brand=<script>alert('XSS')</script>" http://<target>/oews/classes/Master.php?f=save_product | grep "<script>alert('XSS')</script>"

• generic web:

curl -I http://<target>/oews/classes/Master.php?f=save_product&brand=<script>alert('XSS')</script>

• generic web: Examine access logs for requests to /oews/classes/Master.php?f=save_product containing suspicious characters or JavaScript code in the 'brand' parameter. • generic web: Check response headers for signs of XSS, such as Content-Security-Policy (CSP) headers that are not properly configured.

1. 2024-11-15Disclosure

   disclosure

2. 2024-11-15Patch

   patch

1. Reserviert2024-11-15
2. Veröffentlicht2024-11-15
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-11247 is to immediately upgrade to version 1.0.1 of Online Eyewear Shop. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the /oews/classes/Master.php?f=save_product endpoint to sanitize user-supplied data. Web application firewalls (WAFs) can be configured to filter out malicious requests containing suspicious JavaScript code. Review and strengthen the application's overall security posture, including regular security audits and penetration testing. After upgrading, verify the fix by attempting to inject a simple JavaScript payload (e.g., <script>alert('XSS')</script>) through the 'brand' parameter and confirming that it is properly sanitized.