PT-2024-22019
CVE-2024-27743
·
Published
2024-02-29
·
Updated
2025-03-28
Description by
CVSS 3.1
6.1
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Petrol Pump Management Software version 1.0
Description
The issue allows an attacker to execute arbitrary code via a crafted payload to the
Address parameter in the "add invoices.php" component. This enables the attacker to perform Cross Site Scripting attacks.Recommendations
For Petrol Pump Management Software version 1.0, consider restricting access to the "add invoices.php" component until a patch is available, and avoid using the
Address parameter in this component to minimize the risk of exploitation.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾