CVE-2024-11247: XSS in Online Eyewear Shop 1.0

The XSS vulnerability in Online Eyewear Shop allows an attacker to inject malicious JavaScript code into the application. This code can then be executed in the context of a user's browser when they visit the affected page. An attacker could leverage this to steal session cookies, redirect users to phishing sites, or deface the website. The impact is amplified if the application handles sensitive user data, such as payment information or personal details, as the attacker could potentially intercept this data. The remote nature of the vulnerability means an attacker doesn't need to be authenticated to exploit it, significantly broadening the potential attack surface. Similar XSS vulnerabilities in other e-commerce platforms have been used to deploy malware and steal user credentials.

1. Reserved2024-11-15
2. Published2024-11-15
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-11247 is to immediately upgrade to version 1.0.1 of Online Eyewear Shop. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the /oews/classes/Master.php?f=save_product endpoint to sanitize user-supplied data. Web application firewalls (WAFs) can be configured to filter out malicious requests containing suspicious JavaScript code. Review and strengthen the application's overall security posture, including regular security audits and penetration testing. After upgrading, verify the fix by attempting to inject a simple JavaScript payload (e.g., <script>alert('XSS')</script>) through the 'brand' parameter and confirming that it is properly sanitized.