vendor:
Petrol Pump Management Software
by:
Shubham Pandey
6.1
CVSS
HIGH
Stored Cross Site Scripting (XSS)
79
CWE
Product Name: Petrol Pump Management Software
Affected Version From: 1
Affected Version To: 1
Patch Exists: NO
Related CWE: CVE-2024-27744
CPE: a:petrol_pump_management_software:1.0
Platforms Tested: Windows, Linux
2024
Petrol Pump Management Software v.1.0 – Stored Cross Site Scripting via SVG file
A Stored Cross Site Scripting vulnerability in Petrol Pump Management Software v.1.0 allows attackers to execute malicious code by uploading a crafted payload to the 'Image' parameter in the 'profile.php' component. By uploading an 'xss.svg' file, an attacker can inject arbitrary scripts into the application.
Mitigation:
To mitigate this vulnerability, sanitize user inputs to remove any potentially malicious content. Additionally, restrict file uploads to only allow specific file types and validate uploaded files thoroughly.
