PT-2024-22020 · Unknown · Petrol Pump Management

Shubham Pandey · Published 2024-02-29 · Updated 2025-03-28 · CVE-2024-27744

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Petrol Pump Management Software version 1.0

Description The issue allows an attacker to execute arbitrary code via a crafted payload to the image parameter in the "profile.php" component. This is a Cross Site Scripting vulnerability.

Recommendations For Petrol Pump Management Software version 1.0, consider disabling the image parameter in the profile.php component until a patch is available. Restrict access to the profile.php component to minimize the risk of exploitation. Avoid using the image parameter in the affected component until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-27744

Affected Products

Petrol Pump Management

References · 9

• 🔥 https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27744.md · Exploit
• 🔥 https://exploit-db.com/exploits/51837 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-27744 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27744 · Vendor Advisory
• https://t.me/cvenotify/116754 · Telegram Post
• https://t.me/cvenotify/73687 · Telegram Post
• https://twitter.com/shubhamspandey_/status/1763374274440536491 · Twitter Post
• https://t.me/cvenotify/90945 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1763713608960061491 · Twitter Post