PT-2024-22021 · Unknown · Petrol Pump Management

Shubham Pandey · Published 2024-02-29 · Updated 2025-03-28 · CVE-2024-27746

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Petrol Pump Mangement Software version 1.0

Description The issue allows an attacker to execute arbitrary code via a crafted payload to the email address parameter in the "index.php" component. This enables the attacker to inject malicious SQL code, potentially leading to unauthorized access or data manipulation.

Recommendations For Petrol Pump Mangement Software version 1.0, consider restricting access to the "index.php" component to minimize the risk of exploitation. As a temporary workaround, avoid using the email address parameter in the affected component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-27746

Affected Products

Petrol Pump Management

References · 9

• 🔥 https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27746.md · Exploit
• 🔥 https://exploit-db.com/exploits/51838 · Exploit
• https://osv.dev/vulnerability/CVE-2024-27746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27746 · Security Note
• https://t.me/cvenotify/92502 · Telegram Post
• https://t.me/cvenotify/116755 · Telegram Post
• https://t.me/cvenotify/73688 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1763713355737346134 · Twitter Post
• https://twitter.com/shubhamspandey_/status/1763374274440536491 · Twitter Post