CVE-2025-3018
Published: 31 March 2025
Summary
CVE-2025-3018 is a medium-severity Injection (CWE-74) vulnerability in Oretnom23 Online Eyewear Shop. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-3018 is a critical SQL injection vulnerability (CWE-74, CWE-89) in SourceCodester Online Eyewear Shop 1.0. The flaw resides in an unknown function within the file /classes/Users.php?f=delete, where manipulation of the ID argument triggers the injection.
The vulnerability is exploitable remotely over the network with low attack complexity and requires low privileges (PR:L) but no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, score 6.3). An authenticated attacker with basic access can leverage it to achieve limited impacts on confidentiality, integrity, and availability, such as partial data exposure, modification, or disruption.
VulDB advisories (ctiid.302070, id.302070, submit.524623) document the issue, and a public exploit is available on GitHub at csemfl/cve/blob/main/sql.md. The vendor's site is sourcecodester.com, but no patches or specific mitigations are detailed in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9014
Vulnerability details
A vulnerability, which was classified as critical, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes/Users.php?f=delete. The manipulation of the argument ID leads to sql injection. It is possible to launch the…
more
attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (/classes/Users.php?f=delete) enables exploitation for initial access (T1190) and data collection from databases via arbitrary SQL queries (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation of the manipulated ID argument before its use in database queries within Users.php.
Mandates timely identification, reporting, and correction of the specific SQL injection flaw in the delete function to eliminate exploitability.
Restricts types and quantities of inputs for the ID parameter, blocking common SQL injection payloads as a complementary measure.