A vulnerability was found in SourceCodester Online Eyewear Shop 1

CVE-2025-0173 is a SQL injection flaw in SourceCodester Online Eyewear Shop 1.0 at orders/view_order.php, where the id parameter is not safely handled before reaching the database. The product page describes this as a free PHP/MySQL source-code project for educational use, and the vulnerable path sits in the customer order area, which strongly suggests the practical attack path usually starts from a logged-in client account or open self-registration rather than true unauthenticated internet spray.

The vendor's MEDIUM 6.3 rating is basically right in spirit, even if the word *critical* appears in some mirrored descriptions. Yes, SQLi is always worth respecting, and public exploit references exist; but the real-world pressure is reduced by the product's very small enterprise footprint, the likely low-privilege/customer-context prerequisite, the absence of KEV or campaign evidence, and the fact that the documented impact is limited to low confidentiality, integrity, and availability loss rather than clean RCE.

Why this verdict

• Started at vendor 6.3 MEDIUM because this is remote SQLi with public exploit references, but the published vector already bakes in PR:L rather than unauthenticated reach.
• Downgrade pressure: attacker position is not true pre-auth internet. Requiring authenticated remote access or open registration implies a prior stage and immediately cuts reachable population compared with perimeter RCEs and pre-auth SQLi.
• Downgrade pressure: exposure population is tiny. This is a SourceCodester educational PHP project, not a ubiquitous enterprise product, so even a valid bug lands on far fewer real targets.
• Downgrade pressure: low observed exploitation evidence. No KEV listing, no campaign reporting in the consulted sources, and a very low EPSS all argue against emergency-tier handling.
• Floor on severity: public exploit lineage and internet-facing data path still matter. If you do run this app, exploitation is technically straightforward enough to expose or tamper with customer/order data.

Why not higher?

This is not supported by current evidence as a broad, unauthenticated, internet-scale compromise vector. The likely need for customer-level access or open registration, combined with a niche deployment base and no active exploitation signal, keeps it out of HIGH.

Why not lower?

It is still a genuine SQL injection on a web-exposed route, with public exploit references and low technical complexity once the endpoint is reachable. If the application is actually in use, dismissing it as backlog noise would understate the risk to customer and order data.

1. Put the order route behind stronger access controls — Require authenticated access to customer order pages and, where possible, restrict direct object access checks to the logged-in owner. For a MEDIUM finding there is no mitigation SLA, but if this app is public-facing you should still harden the route during normal remediation planning rather than waiting for a code rewrite.
2. Apply a targeted WAF rule for SQLi on view_order.php — Block or challenge requests to orders/view_order.php with SQL metacharacters, tautologies, comments, or anomalous id values. This is a practical containment step when no vendor patch is documented; for MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window, but WAFing the endpoint lowers exposure now.
3. Reduce database privileges for the app account — Constrain the application's DB user to the minimum tables and operations needed so a successful injection cannot become whole-database theft or tampering. This does not fix the bug, but it cuts blast radius while you execute remediation within the 365-day window for a MEDIUM issue.
4. Monitor for abuse on the order endpoint — Alert on repeated requests to view_order.php with odd id patterns, SQL keywords, or rapid sequential enumeration. This is especially useful if self-registration is enabled and gives you a detection backstop while remediation is scheduled.

Run this on the target web server that hosts the SourceCodester codebase, not from an auditor workstation. Invoke it as sudo bash verify_cve_2025_0173.sh /var/www/html/oews with read access to the application files; root is not strictly required if the web root is readable.

#!/usr/bin/env bash
# verify_cve_2025_0173.sh
# Check SourceCodester Online Eyewear Shop for likely exposure to CVE-2025-0173
# Usage: bash verify_cve_2025_0173.sh /path/to/oews
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

APP_ROOT="${1:-}"
if [[ -z "$APP_ROOT" ]]; then
  echo "UNKNOWN - usage: bash $0 /path/to/oews"
  exit 2
fi

TARGET="$APP_ROOT/orders/view_order.php"
if [[ ! -f "$TARGET" ]]; then
  echo "UNKNOWN - file not found: $TARGET"
  exit 2
fi

content="$(tr '\n' ' ' < "$TARGET")"

# Heuristics:
# - vulnerable if the file references GET id and appears to build SQL unsafely
# - patched if it casts the id to int or uses prepared statements / bound params

has_get_id=0
has_prepare=0
has_bind=0
has_int_cast=0
has_sql_concat=0

grep -Eq "\$_GET\[['\"]id['\"]\]" "$TARGET" && has_get_id=1
grep -Eq "prepare\s*\(" "$TARGET" && has_prepare=1
grep -Eq "bind_param\s*\(|bindValue\s*\(|execute\s*\(" "$TARGET" && has_bind=1
grep -Eq "intval\s*\(\s*\$_GET\[['\"]id['\"]\]\s*\)|\(int\)\s*\$_GET\[['\"]id['\"]\]" "$TARGET" && has_int_cast=1

# crude concat patterns common in PHP/MySQL sample apps
if grep -Eq "(SELECT|UPDATE|DELETE).*\.(\s*)\$_GET\[['\"]id['\"]\]" "$TARGET"; then
  has_sql_concat=1
fi
if grep -Eq "(SELECT|UPDATE|DELETE).*(id|order_id)\s*=\s*['\"]?\s*\$[_A-Za-z][A-Za-z0-9_]*" "$TARGET"; then
  has_sql_concat=1
fi

if [[ $has_get_id -eq 1 && $has_sql_concat -eq 1 && $has_prepare -eq 0 && $has_bind -eq 0 && $has_int_cast -eq 0 ]]; then
  echo "VULNERABLE - likely unsafe use of GET id in $TARGET"
  exit 1
fi

if [[ $has_prepare -eq 1 || $has_bind -eq 1 || $has_int_cast -eq 1 ]]; then
  echo "PATCHED - input appears constrained or parameterized in $TARGET"
  exit 0
fi

echo "UNKNOWN - manual review required for $TARGET"
exit 2

Sources

1. NVD CVE-2025-0173
2. OpenCVE record for CVE-2025-0173
3. OSV record for CVE-2025-0173
4. SourceCodester project page for Online Eyewear Shop
5. CISA Known Exploited Vulnerabilities catalog
6. FIRST EPSS documentation
7. Indusface January 2025 Zero-Day Vulnerability Coverage Bulletin
8. Tenable CVE page for CVE-2025-0173