CVE-2024-2059: Petrol Pump Management RCE Vulnerability

CVE-2024-2059 Overview

CVE-2024-2059 is an unrestricted file upload vulnerability in SourceCodester Petrol Pump Management Software 1.0, developed by Mayurik. The flaw resides in the /admin/app/service_crud.php script, where the photo parameter accepts uploads without validating the file type or content. An attacker with administrative access can upload arbitrary files, including server-side scripts, to achieve remote code execution. The vulnerability is tracked as VulDB identifier VDB-255374 and is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. Public exploit details have been disclosed, increasing the risk of opportunistic exploitation against exposed instances.

Critical Impact
Successful exploitation allows an authenticated attacker to upload and execute arbitrary PHP files on the web server, resulting in full compromise of the application and underlying host.

Affected Products

Mayurik (SourceCodester) Petrol Pump Management Software 1.0
Deployments using the vulnerable /admin/app/service_crud.php endpoint
Web servers hosting the application with PHP execution enabled in the upload directory

Discovery Timeline

2024-03-01 - CVE-2024-2059 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2059

Vulnerability Analysis

The vulnerability exists in the service management functionality of Petrol Pump Management Software 1.0. The service_crud.php script processes multipart form submissions containing a photo parameter used to attach an image to service records. The handler writes the uploaded file to a web-accessible directory without verifying the extension, MIME type, or file signature.

Because PHP files placed in the upload location are executed by the web server, an attacker can upload a webshell disguised as an image. Requesting the uploaded file then executes arbitrary PHP code in the context of the web server user. This yields command execution, database access, and lateral movement opportunities within the hosting environment.

The attack requires network reachability to the admin interface and valid administrative privileges to invoke the CRUD endpoint. Exploitation is straightforward and does not require user interaction.

Root Cause

The root cause is missing server-side validation of file uploads in service_crud.php. The code accepts the photo field from the request and writes it directly to disk without an allowlist of permitted extensions, MIME sniffing, or renaming to a non-executable filename. This aligns with [CWE-434], where an application permits upload of files that can be processed within the application's context.

Attack Vector

An attacker submits a POST request to /admin/app/service_crud.php containing a malicious PHP file in the photo field. After the file is written to the uploads directory, the attacker retrieves the file via HTTP to trigger PHP interpretation. Once the webshell executes, the attacker can run operating system commands, exfiltrate database credentials stored in configuration files, and pivot to other systems on the network.

A public proof-of-concept describing the request flow is available in the GitHub PoC for CVE-2024-2059 and referenced in VulDB #255374.

Detection Methods for CVE-2024-2059

Indicators of Compromise

POST requests to /admin/app/service_crud.php containing multipart uploads where the photo field carries .php, .phtml, .phar, or double-extension filenames such as shell.php.jpg.
New files with executable extensions appearing in the application's upload directory outside of normal administrative activity.
Outbound connections or command execution originating from the web server process shortly after an upload event.

Detection Strategies

Inspect web server access logs for POST requests to service_crud.php followed by GET requests to newly created files in the uploads path.
Deploy file integrity monitoring on the web root and upload directories to alert on creation of PHP or script files.
Use web application firewall (WAF) rules that inspect multipart form uploads for executable content signatures and block non-image MIME types on image fields.

Monitoring Recommendations

Forward web server, PHP-FPM, and host process logs to a centralized analytics platform to correlate upload events with subsequent process execution.
Monitor the web server user account for spawning of shells, curl, wget, or scripting interpreters, which typically indicate webshell activity.
Track authentication events to the admin panel and flag sessions that immediately perform file upload operations from unusual source addresses.

How to Mitigate CVE-2024-2059

Immediate Actions Required

Restrict network access to the /admin/ path using IP allowlists, VPN, or reverse-proxy authentication until a fix is applied.
Rotate all administrative credentials and audit accounts for unauthorized additions.
Review the uploads directory for unexpected files and remove any script content; treat affected hosts as potentially compromised and perform forensic triage.

Patch Information

No official vendor patch has been published for Petrol Pump Management Software 1.0 at the time of writing. Operators should monitor the Mayurik SourceCodester project page for updates and consider replacing the application if the vendor does not issue a fix.

Workarounds

Disable PHP execution in the upload directory using web server configuration (for example, an Apache .htaccess directive or Nginx location block that denies script handling).
Modify service_crud.php to enforce an extension allowlist (jpg, jpeg, png, gif), validate MIME type with finfo_file, and rename uploaded files to random identifiers.
Store uploaded files outside the web root and serve them through a controlled download handler that sets a non-executable content type.

bash

# Apache: block script execution in the uploads directory
# Place this .htaccess file inside the uploads folder
<FilesMatch "\.(php|phtml|phar|pl|py|jsp|asp|sh|cgi)$">
    Require all denied
</FilesMatch>
php_flag engine off

# Nginx equivalent inside the server block
location ^~ /admin/app/uploads/ {
    location ~ \.(php|phtml|phar)$ { deny all; }
}