PT-2024-22019 · Unknown · Petrol Pump Management

Shubham Pandey · Published 2024-02-29 · Updated 2025-03-28 · CVE-2024-27743

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Petrol Pump Management Software version 1.0

Description The issue allows an attacker to execute arbitrary code via a crafted payload to the Address parameter in the "add invoices.php" component. This enables the attacker to perform Cross Site Scripting attacks.

Recommendations For Petrol Pump Management Software version 1.0, consider restricting access to the "add invoices.php" component until a patch is available, and avoid using the Address parameter in this component to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-27743

Affected Products

Petrol Pump Management

References · 8

• 🔥 https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27743.md · Exploit
• 🔥 https://exploit-db.com/exploits/51836 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-27743 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27743 · Vendor Advisory
• https://t.me/cvenotify/115951 · Telegram Post
• https://t.me/cvenotify/73686 · Telegram Post
• https://t.me/cvenotify/116753 · Telegram Post
• https://twitter.com/shubhamspandey_/status/1763374274440536491 · Twitter Post