CVE-2024-9082: oretnom23 online_eyewear_shop Incorrect Privilege Assignment

Vulnerability summary

CVE-2024-9082 is a critical (CVSS 9.8) Incorrect Privilege Assignment vulnerability in oretnom23 online_eyewear_shop. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 44.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-09-2024
   PublishedVulnerability first disclosed.
2. 31-03-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save of the component User Creation Handler. The manipulation of the argument Type with the input 1 leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.