CVE-2025-4173

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function delete_cart of the file /oews/classes/Master.php?f=delete_cart. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Online Eyewear Shop	1.0

References

https://github.com/huashuocc/cve/blob/main/sql.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.306793Permissions Required, VDB Entry
https://vuldb.com/?id.306793Third Party Advisory, VDB Entry
https://vuldb.com/?submit.561737Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product
https://github.com/huashuocc/cve/blob/main/sql.mdExploit, Third Party Advisory

Timeline

Published: May 1, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-417309.8An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size CVE-2025-417317.4A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker wi CVE-2025-417329.8An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size CVE-2025-417339.8The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker CVE-2025-417349.8An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.CVE-2025-417358.8A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.CVE-2025-417368.8A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in CVE-2025-417377.5Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.CVE-2025-417387.5An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a poin CVE-2025-417395.9An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runti CVE-2025-41749.8A vulnerability, which was classified as critical, has been found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this issu CVE-2025-417429.8Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptogr