CVE-2024-27746: SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address…

PriorityP267critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

12.95%

95.8th percentile

SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address parameter in the index.php component.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
mayurik	petrol_pump_management	—	—

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://localhost/fuelflow/index.php↗

path/fuelflow/index.php↗

command[email protected]';SELECT SLEEP(10)#↗

→Monitor HTTP POST requests to /fuelflow/index.php for SQL injection patterns in the email address parameter, specifically time-based blind SQLi payloads containing SLEEP() or similar delay functions. ↗
→Detect login attempts where the email/username field contains SQL metacharacters such as single quotes ('), comment sequences (#, --), or SQL keywords (SELECT, SLEEP, UNION) — indicative of time-based blind SQL injection exploitation. ↗
→Alert on abnormally long HTTP response times (e.g., ~10 seconds) from /fuelflow/index.php login requests, which may indicate successful time-based SQL injection via SLEEP() payloads. ↗

·The exploit was tested against a locally hosted instance; the application root path '/fuelflow/' may vary across deployments. Adjust detection rules to account for alternate installation paths. ↗
·The PoC uses a time-based blind SQL injection technique (SLEEP(10)); attackers may vary the delay value or use alternative time-delay functions to evade fixed-threshold detection. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.