CVE-2024-2061: Petrol Pump Management SQLi Vulnerability

CVE-2024-2061 Overview

CVE-2024-2061 is a SQL injection vulnerability in SourceCodester Petrol Pump Management Software 1.0, developed by Mayurik. The flaw exists in /admin/edit_supplier.php, where the id parameter is passed directly into a database query without proper sanitization [CWE-89]. Attackers with authenticated access can manipulate the parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed under VulDB identifier VDB-255376 and can be executed remotely over the network.

Critical Impact
Successful exploitation allows an authenticated remote attacker to read, modify, or delete database contents, potentially compromising supplier records, credentials, and operational data stored by the application.

Affected Products

Mayurik Petrol Pump Management Software 1.0
SourceCodester Petrol Pump Management Software 1.0
The /admin/edit_supplier.php endpoint specifically

Discovery Timeline

2024-03-01 - CVE-2024-2061 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2061

Vulnerability Analysis

The vulnerability resides in the administrative supplier-editing workflow of Petrol Pump Management Software 1.0. When a user navigates to /admin/edit_supplier.php, the application accepts an id query parameter identifying the supplier record to edit. This parameter is concatenated into a SQL statement without parameterized queries or input validation.

An attacker who can reach the admin interface can substitute the numeric id with SQL payloads. The database engine then executes attacker-controlled statements alongside the legitimate query. This enables data extraction using UNION-based techniques, blind boolean or time-based inference, and potentially write operations against the underlying schema.

The issue is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Exploitation requires high privileges according to the CVSS vector, indicating the endpoint sits behind administrative authentication.

Root Cause

The root cause is direct interpolation of the untrusted id parameter into a SQL query string in edit_supplier.php. The application does not use prepared statements, parameter binding, or type casting before constructing the query. Any character supplied in id, including quotes and SQL keywords, is interpreted by the database engine.

Attack Vector

The attack requires network access to the admin panel and valid administrative credentials. An attacker sends a crafted HTTP request such as GET /admin/edit_supplier.php?id=1' UNION SELECT ...--. The malicious id value terminates the intended query context and appends attacker-controlled SQL. See the public write-up at GitHub SQL Injection Exploit for a documented request sequence.

Detection Methods for CVE-2024-2061

Indicators of Compromise

HTTP requests to /admin/edit_supplier.php containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment markers (--, #) in the id parameter.
Unusually long or URL-encoded values for the id query parameter that deviate from expected numeric identifiers.
Database error messages returned in HTTP responses referencing MySQL syntax errors originating from supplier queries.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL injection payloads targeting the id parameter on supplier administration endpoints.
Enable database query logging and alert on statements against the supplier table that contain UNION operators or subqueries originating from the web application user.
Correlate web server access logs with database audit logs to identify anomalous query patterns tied to specific administrative sessions.

Monitoring Recommendations

Continuously monitor administrative endpoint access for unauthorized authentication attempts and session anomalies.
Baseline normal parameter values for edit_supplier.php and alert on deviations from integer-only inputs.
Retain HTTP and database logs for a minimum of 90 days to support post-incident investigation.

How to Mitigate CVE-2024-2061

Immediate Actions Required

Restrict network access to /admin/ paths using IP allowlisting, VPN gating, or reverse-proxy authentication until a code-level fix is applied.
Rotate all administrative credentials and audit the supplier table for unauthorized modifications.
Deploy WAF rules blocking SQL metacharacters in the id parameter of edit_supplier.php.

Patch Information

No vendor patch has been published for Mayurik Petrol Pump Management Software 1.0 as of the last NVD update. Organizations running this application should evaluate whether continued use is justified given the lack of vendor remediation. Refer to VulDB #255376 for advisory tracking.

Workarounds

Modify edit_supplier.php to use parameterized queries with PDO or mysqli prepared statements, binding the id value as an integer.
Add server-side input validation that rejects any id value that is not a positive integer before it reaches the database layer.
Enforce least-privilege database accounts so the web application user cannot execute schema-altering or cross-table queries.

bash

# Example nginx location block restricting admin access by source IP
location /admin/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://backend;
}