CVE-2024-2058: Petrol Pump Management Software RCE Flaw

CVE-2024-2058 Overview

CVE-2024-2058 is an unrestricted file upload vulnerability in SourceCodester Petrol Pump Management Software 1.0, developed by Mayurik. The flaw resides in the /admin/app/product.php endpoint, where the photo parameter accepts arbitrary file content without proper validation. Attackers can upload malicious files, including server-side scripts, to the target host. The exploit has been publicly disclosed and can be launched remotely over the network. VulDB assigned identifier VDB-255373 to this issue, and the weakness maps to [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Successful exploitation allows attackers to upload web shells to the application server, leading to arbitrary code execution and full compromise of the underlying host.

Affected Products

Mayurik Petrol Pump Management Software 1.0
Component: /admin/app/product.php
Deployments distributed via SourceCodester

Discovery Timeline

2024-03-01 - CVE-2024-2058 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2058

Vulnerability Analysis

The vulnerability exists in the product management workflow of the administrative interface. The product.php script processes multipart form submissions and writes the uploaded photo file to a web-accessible directory. The application does not enforce MIME type validation, file extension allow-listing, or content inspection prior to writing the file. Attackers with access to the admin endpoint can therefore submit a PHP script disguised as an image and request it through the web server to trigger execution.

Because the upload handler stores the file under a predictable path, post-exploitation is straightforward. An attacker gains command execution in the context of the web server user, which typically permits reading configuration files, pivoting into the database, and establishing persistence.

Root Cause

The root cause is missing server-side validation of user-supplied file content and extension in the photo upload parameter. The application relies on client-side controls and trusts the submitted filename, which violates the guidance codified in [CWE-434].

Attack Vector

Exploitation occurs over the network against the administrative interface. The attacker submits a crafted multipart/form-data POST request to /admin/app/product.php with the photo field containing an executable script such as a PHP web shell. Once written to the web root, the attacker requests the uploaded path directly to invoke the payload.

The vulnerability mechanism is described in the publicly disclosed proof of concept. See the GitHub PoC Repository and VulDB #255373 for the full technical write-up.

Detection Methods for CVE-2024-2058

Indicators of Compromise

Unexpected .php, .phtml, or .phar files present under directories that store product images uploaded via /admin/app/product.php.
Web server access logs containing POST requests to /admin/app/product.php followed by GET requests to newly created files in image upload directories.
Outbound network connections initiated from the web server process shortly after file upload events.

Detection Strategies

Inspect web server logs for multipart/form-data submissions to product.php where the photo field references a non-image extension or contains PHP tags in the payload.
Deploy file integrity monitoring on the application's upload directories to alert on the creation of any executable script types.
Correlate web application firewall alerts for file upload signatures with subsequent process creation events on the host running the application.

Monitoring Recommendations

Alert on the web server process (php-fpm, apache2, httpd) spawning shells such as /bin/sh, bash, cmd.exe, or powershell.exe.
Monitor for anomalous outbound connections from the web server, particularly to non-corporate IP ranges or on ports commonly used by reverse shells.
Track authentication events against the admin panel and flag successful logins from unfamiliar source addresses.

How to Mitigate CVE-2024-2058

Immediate Actions Required

Restrict access to /admin/app/product.php at the network or reverse proxy layer, permitting only trusted administrative source addresses.
Rotate credentials for administrative accounts and audit existing accounts for signs of unauthorized use.
Review upload directories for unexpected script files and remove any that cannot be attributed to legitimate uploads.

Patch Information

As of the last NVD update on 2026-06-17, no vendor-supplied patch has been referenced for Mayurik Petrol Pump Management Software 1.0. Operators should treat the affected version as end-of-support unless the vendor publishes a security update. Consult VulDB #255373 for advisory tracking.

Workarounds

Configure the web server to deny script execution within the upload directory using .htaccess rules or equivalent Nginx location directives.
Add a WAF rule that inspects the photo field and blocks requests containing PHP tags, script magic bytes, or non-image extensions.
Enforce authentication and multi-factor authentication in front of the /admin/ path via a reverse proxy until a vendor fix is available.

bash

# Nginx configuration to prevent script execution in upload directory
location ~ ^/admin/app/uploads/ {
    location ~ \.(php|phtml|phar|pl|py|jsp|asp|sh|cgi)$ {
        deny all;
        return 403;
    }
}