CVE-2024-10406: Petrol Pump Management SQL Injection Flaw

CVE-2024-10406 Overview

CVE-2024-10406 is a SQL injection vulnerability [CWE-89] in SourceCodester Petrol Pump Management Software 1.0, produced by Mayurik. The flaw resides in the /admin/edit_fuel.php script, where the id parameter is passed directly into a database query without sanitization. Authenticated attackers can manipulate the parameter to inject arbitrary SQL statements remotely over the network. The exploit has been disclosed publicly, increasing the likelihood of opportunistic abuse against exposed installations.

Critical Impact
Remote attackers with low-privileged access can execute arbitrary SQL queries against the backend database, leading to unauthorized data access, modification, or deletion.

Affected Products

Mayurik Petrol Pump Management Software 1.0
CPE: cpe:2.3:a:mayurik:petrol_pump_management:1.0
Vulnerable component: /admin/edit_fuel.php

Discovery Timeline

2024-10-26 - CVE-2024-10406 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10406

Vulnerability Analysis

The vulnerability exists in the administrative fuel-editing endpoint of Petrol Pump Management Software 1.0. The /admin/edit_fuel.php script accepts an id query parameter and concatenates it directly into a SQL statement. This absence of input validation and parameterization allows attackers to break out of the intended query context. The Common Weakness Enumeration classification is [CWE-89], SQL Injection.

Successful exploitation can expose customer records, fuel inventory data, and administrative credentials stored within the backend database. Because the endpoint sits behind the admin interface, an attacker needs valid low-privileged credentials, matching the PR:L component of the CVSS vector. The disclosure of a public proof-of-concept lowers the bar for reproducing the attack.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. Developer code passes the id parameter from the HTTP request straight into a query string rather than binding it as a parameter. Any SQL metacharacters supplied by the attacker are interpreted by the database engine.

Attack Vector

An authenticated attacker sends a crafted HTTP request to /admin/edit_fuel.php with a malicious payload appended to the id parameter. Typical payloads use UNION-based, boolean-based, or time-based techniques to extract data from the underlying MySQL database. Because the attack occurs over the network, no local access to the pump management server is required.

The vulnerability manifests when the id parameter of /admin/edit_fuel.php is concatenated into a SQL query. See the GitHub PoC repository and VulDB entry #281936 for reproduction details.

Detection Methods for CVE-2024-10406

Indicators of Compromise

HTTP requests to /admin/edit_fuel.php containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, or comment sequences like -- and # in the id parameter.
Unusually long or URL-encoded values for the id query parameter in web server access logs.
Database error messages referencing edit_fuel.php in application or PHP error logs.
Unexpected administrative session activity originating from external IP addresses.

Detection Strategies

Deploy web application firewall rules that inspect the id parameter on /admin/edit_fuel.php for SQL injection patterns.
Enable database query logging and alert on anomalous query structures against fuel-management tables.
Correlate authentication events with sudden spikes in requests to the admin interface.

Monitoring Recommendations

Monitor web server access logs for repeated 500-series responses tied to the vulnerable endpoint.
Track outbound database connections from the PHP application for unexpected data-volume changes.
Baseline normal admin activity so that deviations in query frequency or size trigger alerts.

How to Mitigate CVE-2024-10406

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allow-lists or VPN-only access.
Rotate all administrative credentials for the Petrol Pump Management application.
Audit the backend database for unauthorized modifications to fuel, sales, and user tables.
Enforce web application firewall rules that block SQL injection patterns on the id parameter.

Patch Information

At the time of publication, no official vendor patch has been released by Mayurik or SourceCodester for CVE-2024-10406. Refer to SourceCodester Security Resources and the VulDB advisory for updates. Organizations should treat the software as unpatched and apply compensating controls.

Workarounds

Modify /admin/edit_fuel.php to use parameterized queries or prepared statements via PDO or mysqli bindings.
Implement strict server-side input validation to cast the id parameter to an integer before use.
Place the application behind a reverse proxy that enforces authentication and inspects request payloads.
Consider retiring Petrol Pump Management Software 1.0 if a maintained alternative is available.

bash

# Example WAF rule (ModSecurity) to block SQLi on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /admin/edit_fuel.php" \
    "chain,phase:2,deny,status:403,id:1024106,\
     msg:'CVE-2024-10406 SQLi attempt on edit_fuel.php'"
    SecRule ARGS:id "@rx (?i)(union|select|sleep\(|--|#|')" "t:none,t:urlDecode"