CVE-2024-8336
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Music Gallery Site 1.0 allows attackers to execute arbitrary SQL commands via the 'id' parameter in the delete_music function. Attackers can remotely exploit this to manipulate or extract database contents. All users running the vulnerable version of this software are affected.
💻 Affected Systems
- SourceCodester Music Gallery Site
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, or full system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized data access, modification, or deletion of music gallery content and user data.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to the music gallery application data.
🎯 Exploit Status
Public exploit available on GitHub, simple SQL injection via URL parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to ensure 'id' parameter contains only numeric values
Modify /php-music/classes/Master.php to validate $_GET['id'] with is_numeric() or filter_var()
Web Application Firewall Rule
allBlock SQL injection patterns targeting the delete_music endpoint
Add WAF rule to block requests containing SQL keywords in the 'id' parameter
🧯 If You Can't Patch
- Remove or restrict access to the vulnerable endpoint via web server configuration
- Implement network segmentation to isolate the vulnerable system from critical assets
🔍 How to Verify
Check if Vulnerable:
Test by accessing /php-music/classes/Master.php?f=delete_music&id=1' OR '1'='1 and checking for SQL errorsCheck Version:
Check application version in source code or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in application logs
- Unusual database queries from web server IP
Network Indicators:
- HTTP requests to /php-music/classes/Master.php with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/php-music/classes/Master.php" AND (param="id" AND value MATCH "[';]|UNION|SELECT|OR")