CVE-2024-6067: Music Class Enrollment System SQLi Flaw

CVE-2024-6067 Overview

CVE-2024-6067 is a SQL injection vulnerability in SourceCodester Music Class Enrollment System 1.0, developed by oretnom23. The flaw resides in the /mces/?p=class/view_class endpoint, where the id parameter is passed directly into a backend SQL query without proper sanitization. Remote attackers with low-level authenticated access can manipulate the parameter to inject arbitrary SQL statements. The exploit details have been publicly disclosed under VulDB identifier VDB-268795, increasing the likelihood of opportunistic exploitation against exposed instances. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Authenticated remote attackers can extract, modify, or delete database contents by injecting SQL payloads into the id parameter of the view_class endpoint.

Affected Products

• SourceCodester Music Class Enrollment System 1.0
• oretnom23 music_class_enrollment_system version 1.0
• Deployments exposing the /mces/?p=class/view_class endpoint

Discovery Timeline

• 2024-06-17 - CVE-2024-6067 published to NVD with public exploit disclosure
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6067

Vulnerability Analysis

The Music Class Enrollment System is a PHP-based web application designed to manage student enrollment for music courses. The application passes user-supplied input from the id query parameter into a SQL statement responsible for retrieving class details. Because the application does not use parameterized queries or input validation, attackers can break out of the intended SQL context and append arbitrary clauses.

A successful injection allows extraction of arbitrary table contents through UNION-based queries, blind data exfiltration via time-based payloads, or destructive operations using stacked statements where the underlying database driver supports them. Sensitive data including student records, instructor credentials, and administrative session identifiers may be exposed. Public exploit analysis is available via the GitHub SQLi Exploit Analysis.

Root Cause

The root cause is direct concatenation of the unsanitized id HTTP GET parameter into a backend SQL statement within the view_class controller. The application does not enforce type casting, allowlist validation, or prepared statements, leaving the query structure under attacker control.

Attack Vector

The attack vector is network-based and requires low-level privileges to access the authenticated portion of the application. An attacker submits a crafted HTTP GET request to /mces/?p=class/view_class&id=<payload>, where the payload contains SQL syntax such as UNION SELECT clauses or boolean-based blind injection expressions. No user interaction is required beyond initial authentication.

The vulnerability mechanism is documented in the public proof-of-concept referenced in VulDB Exploit ID #268795. No verified code examples are reproduced here; refer to the linked advisory for technical payload details.

Detection Methods for CVE-2024-6067

Indicators of Compromise

• HTTP requests to /mces/?p=class/view_class containing SQL metacharacters such as ', ", --, UNION, SELECT, or SLEEP( in the id parameter
• Web server access logs showing unusually long or URL-encoded id values from a single source IP
• Database error messages returned in HTTP responses referencing MySQL syntax errors
• Unexpected outbound database query patterns originating from the Music Class Enrollment System application user

Detection Strategies

• Deploy Web Application Firewall (WAF) signatures for SQL injection patterns targeting the id parameter on the view_class route
• Enable database query logging and alert on queries originating from the application service account that contain UNION SELECT or INFORMATION_SCHEMA references
• Correlate authentication events with subsequent malformed query patterns to identify compromised low-privilege accounts

Monitoring Recommendations

• Monitor for repeated HTTP 500 responses from the /mces/ application path, which often indicate active injection probing
• Track database read volume from the application account and alert on anomalous spikes consistent with bulk extraction
• Review authentication logs for brute-force or credential-stuffing attempts that precede injection activity

How to Mitigate CVE-2024-6067

Immediate Actions Required

• Restrict network access to the Music Class Enrollment System to trusted IP ranges using firewall or reverse-proxy rules
• Audit existing accounts and rotate credentials for any users with access to the affected application
• Inspect database contents for unauthorized modifications, particularly in user, session, and class tables
• Enable verbose logging on the web server and database to capture any exploitation attempts

Patch Information

No vendor-supplied patch is referenced in the NVD entry or associated VulDB records for CVE-2024-6067 at the time of this writing. Organizations operating SourceCodester Music Class Enrollment System 1.0 should review VulDB Resource ID #268795 for vendor response status. In the absence of an official patch, code-level remediation requires replacing string-concatenated queries with parameterized statements (prepared statements via PDO or MySQLi) and applying strict integer validation to the id parameter.

Workarounds

• Place the application behind a Web Application Firewall configured to block SQL injection payloads in query string parameters
• Manually patch the view_class handler to cast $_GET['id'] to an integer before use in SQL queries
• Disable or remove the view_class endpoint if it is not required for production operations
• Implement least-privilege database accounts so the application user cannot read sensitive tables or execute administrative SQL commands

# Example mitigating reverse-proxy rule (nginx) to block obvious SQLi patterns
location /mces/ {
    if ($args ~* "(union|select|sleep\(|information_schema|--|';)") {
        return 403;
    }
    proxy_pass http://backend;
}