CVE-2024-2060: Petrol Pump Management Software SQL Injection

CVE-2024-2060 Overview

CVE-2024-2060 is a SQL injection vulnerability in SourceCodester Petrol Pump Management Software 1.0, developed by Mayurik. The flaw exists in /admin/app/login_crud.php, where the email parameter is passed unsanitized into a database query. Authenticated remote attackers can manipulate the parameter to execute arbitrary SQL statements against the backend database. The issue is tracked in VulDB as entry 255375 and has been publicly disclosed with exploit details available.

Critical Impact
Successful exploitation allows attackers to read, modify, or delete database records, bypass authentication logic, and potentially achieve full compromise of the application's data store.

Affected Products

Mayurik Petrol Pump Management Software 1.0
Component: /admin/app/login_crud.php
Vulnerable parameter: email

Discovery Timeline

2024-03-01 - CVE-2024-2060 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2060

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under [CWE-89]. It resides in the login handler login_crud.php inside the /admin/app/ directory of the application. User-supplied input from the email parameter is concatenated into an SQL query without parameterization or sanitization. An attacker can supply crafted SQL syntax through this parameter to alter the query logic executed by the backend database.

Exploitation requires network access to the administrative endpoint. The CWE-89 weakness impacts confidentiality, integrity, and availability of the database. Public exploit information is documented in the GitHub SQL Injection Exploit writeup.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. The login_crud.php handler builds a query string by directly appending the email request parameter rather than using prepared statements or parameterized queries. Any SQL metacharacters supplied by the attacker are interpreted as part of the query syntax.

Attack Vector

The attack is delivered over the network by sending a crafted HTTP request containing malicious SQL fragments in the email field submitted to /admin/app/login_crud.php. The attacker requires existing high-privilege credentials, but no user interaction is needed. Successful injection allows extraction of database contents, tampering with stored records, or denial of service against the database.

No verified proof-of-concept code is included here. Refer to the VulDB #255375 Analysis and VulDB #255375 Details for public technical details.

Detection Methods for CVE-2024-2060

Indicators of Compromise

HTTP POST requests to /admin/app/login_crud.php containing SQL metacharacters such as ', --, UNION, SELECT, or OR 1=1 in the email field.
Database error messages or unexpected response sizes returned from the login endpoint.
Unusual authentication-related database queries in application or MySQL logs originating from the login flow.

Detection Strategies

Deploy web application firewall signatures targeting SQL injection payloads on the email parameter of login_crud.php.
Enable verbose query logging on the backend database and alert on queries containing UNION SELECT, stacked statements, or comment sequences from application accounts.
Baseline normal request patterns to the admin login endpoint and alert on anomalous parameter lengths or non-email syntax.

Monitoring Recommendations

Forward web server access logs and database audit logs to a centralized analytics platform for correlation.
Monitor for authentication bypass indicators such as successful admin logins from previously unseen source IP addresses.
Track outbound data volumes from the database host to detect bulk exfiltration following injection attempts.

How to Mitigate CVE-2024-2060

Immediate Actions Required

Restrict network access to /admin/app/ to trusted administrative IP ranges via firewall or reverse proxy rules.
Rotate all administrative and database credentials, assuming they may have been exposed.
Deploy a web application firewall with SQL injection rules in front of the application until a code fix is applied.

Patch Information

As of the last NVD update on 2026-06-17, no vendor patch has been published by Mayurik for CVE-2024-2060. Organizations running SourceCodester Petrol Pump Management Software 1.0 should treat the application as unpatched and consider decommissioning or replacing it. Monitor the VulDB #255375 Details page for any future vendor advisories.

Workarounds

Modify login_crud.php to use parameterized queries or prepared statements for the email parameter and any other user-controlled input.
Apply server-side input validation to reject non-email syntax before it reaches the database layer.
Enforce least privilege on the database account used by the application so injected queries cannot access unrelated tables.
If the application cannot be modified, isolate it on a segmented network and restrict administrative access to a VPN.

bash

# Configuration example: block SQL metacharacters in the email field at the reverse proxy
# Example ModSecurity rule (conceptual)
SecRule ARGS:email "@rx (['\"();]|--|/\*|\bUNION\b|\bSELECT\b)" \
  "id:1002060,phase:2,deny,status:403,\
   msg:'CVE-2024-2060 SQLi attempt on login_crud.php email parameter',\
   logdata:'%{MATCHED_VAR}'"