CVE-2024-8336: Music Gallery Site SQL Injection Flaw

CVE-2024-8336 Overview

CVE-2024-8336 is a SQL injection vulnerability in SourceCodester Music Gallery Site 1.0, developed by oretnom23. The flaw resides in the /php-music/classes/Master.php?f=delete_music endpoint, where the id parameter is passed to a database query without proper sanitization. Attackers can manipulate the id argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable and requires only low-privilege authentication. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed instances. The weakness is tracked under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Authenticated remote attackers can manipulate the id parameter to execute arbitrary SQL queries, exposing or modifying database contents.

Affected Products

• SourceCodester Music Gallery Site 1.0
• oretnom23 music_gallery_site version 1.0
• Deployments using /php-music/classes/Master.php delete handler

Discovery Timeline

• 2024-08-30 - CVE-2024-8336 published to NVD
• 2024-09-04 - Last updated in NVD database

Technical Details for CVE-2024-8336

Vulnerability Analysis

The vulnerability exists in the delete_music function handler within Master.php. The application accepts a user-supplied id value through an HTTP request and concatenates it directly into a SQL DELETE statement. No parameterized queries, prepared statements, or input sanitization mechanisms are applied before query execution.

An authenticated attacker can append SQL syntax to the id parameter to alter the query's logic. This enables data extraction through union-based or boolean-based blind techniques, as well as destructive operations such as dropping tables or modifying records. Because the affected endpoint executes a DELETE statement, injected payloads may also corrupt data integrity beyond the intended row.

Root Cause

The root cause is improper neutralization of user input [CWE-89]. The id parameter flows directly into a SQL query string without type validation or escaping. PHP applications using mysqli or PDO connections without prepared statements remain susceptible to this class of flaw.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker authenticated to the Music Gallery Site application sends a crafted request to /php-music/classes/Master.php?f=delete_music with a malicious id value. No user interaction is required. Public proof-of-concept material has been published, lowering the barrier to exploitation.

No verified exploit code is reproduced here. Technical exploitation details are documented in the GitHub PoC Repository and VulDB #276211.

Detection Methods for CVE-2024-8336

Indicators of Compromise

• HTTP requests to /php-music/classes/Master.php?f=delete_music containing SQL metacharacters such as ', --, UNION, or SLEEP( in the id parameter
• Unexpected DELETE operations or row counts in the application's MySQL database logs
• Web server access logs showing repeated probing of the delete_music endpoint from a single source IP
• Database error messages returned in HTTP responses referencing SQL syntax

Detection Strategies

• Inspect web server and application logs for non-numeric values in the id query parameter targeting Master.php
• Deploy a web application firewall (WAF) rule set matching common SQL injection signatures against the php-music URI path
• Enable MySQL general query logging on test or staging instances to capture anomalous DELETE statements
• Correlate authentication events with subsequent administrative actions to detect compromised low-privilege accounts

Monitoring Recommendations

• Forward HTTP access logs and MySQL audit logs to a centralized analytics platform for query pattern analysis
• Alert on outbound database connections originating from the Music Gallery Site host outside normal application behavior
• Track failed login attempts followed by access to Master.php endpoints from the same session

How to Mitigate CVE-2024-8336

Immediate Actions Required

• Restrict network access to the Music Gallery Site application using firewall rules or VPN-only access until a fix is available
• Disable or remove the delete_music functionality if it is not required in production
• Audit existing user accounts and rotate credentials, since the attack requires only low privileges
• Review database contents for unauthorized deletions or modifications

Patch Information

No official vendor patch has been published for SourceCodester Music Gallery Site 1.0 at the time of CVE publication. Organizations operating this application should consult the SourceCodester Security Resources page for any updates and apply source-level fixes to convert vulnerable queries to prepared statements.

Workarounds

• Replace dynamic SQL concatenation in Master.php with parameterized queries using mysqli_prepare() or PDO bound parameters
• Cast the id parameter to an integer using intval($_REQUEST['id']) before query construction
• Deploy a WAF in front of the application with rules blocking SQL injection patterns on the php-music path
• Remove the application from public-facing networks if patching cannot be performed

# Configuration example: ModSecurity rule to block SQLi attempts on the vulnerable endpoint
SecRule REQUEST_URI "@contains /php-music/classes/Master.php" \
  "id:1008336,phase:2,deny,status:403,\
   msg:'CVE-2024-8336 SQLi attempt on delete_music',\
   chain"
    SecRule ARGS:id "@detectSQLi" "t:none"