CVE-2024-27747

published 2024-03-01

CVE-2024-27747: File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image…

Priority P2 71 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
mayurik	petrol_pump_management	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://localhost/fuelflow/index.php↗

url http://localhost/fuelflow/admin/profile.php↗

filename phpinfo.php↗

path /fuelflow/admin/profile.php↗

• → Detect multipart file upload POST requests to /fuelflow/admin/profile.php containing PHP files (e.g., .php extension) in the 'Image' field parameter. ↗
• → Default credentials used in exploitation: [email protected] and Password=admin — flag successful logins with these credentials as a precursor indicator. ↗

• · The exploit PoC uses localhost paths; in real deployments the base URL will differ, but the relative paths (/fuelflow/admin/profile.php and /fuelflow/assets/images/) should remain consistent with the default installation. ↗
• · The vulnerability was tested on both Windows and Linux platforms, so detection rules should be platform-agnostic. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434