CVE-2024-2058 is a medium severity unrestricted file upload flaw in SourceCodester Petrol Pump Management Software 1.0, scored CVSS 4.7. The photo argument handled by /admin/app/product.php is not properly restricted. The record names no fixed version, so find every copy, restrict access and check the vendor or project for a patch.
What's affected
The record names SourceCodester Petrol Pump Management Software version 1.0. The weakness is CWE-434, unrestricted file upload. The affected code is /admin/app/product.php, and the manipulated argument is photo. The record says the attack can be launched remotely and that an exploit has been disclosed to the public. It was published on 2024-03-01, and the VulDB identifier is VDB-255373.
The CVSS vector lists high privileges required, which usually means an administrator level account is needed first. One linked write up is titled as an unauthenticated upload, while the CVSS vector says high privileges are required. Both are noted here.
The record does not name a fixed version. We did not retrieve the VulDB entry or the linked write up, so we cannot confirm that a patch exists. Treat the product as unpatched until the vendor or project says otherwise.
How to check if you're exposed
Start with an inventory question. Do you run Petrol Pump Management Software at all? Small standalone PHP applications like this rarely appear in a package manager, so look for deployed source trees instead: web roots, shared hosting accounts, internal tool servers and container images built from a downloaded copy.
If you find one, confirm the version (the record lists 1.0) and confirm the file exists. From the server or a checked out copy:
grep -rn "product.php" /var/www
If the file is present, treat the copy as affected until you have evidence otherwise. We saw no vendor advisory describing a detection method, so there is no official check to point to. Review web server access logs for requests to product.php, and compare them with normal use. Unusual or repeated failing requests to one page deserve a closer look. A log review cannot prove a copy was never abused, but it helps you scope the work.
A dependency scanner will not find a standalone application by itself. You can still run the free in-browser dependency scan on any project that vendors this code, and the Gold page for CVE-2024-2058 tracks the record as it changes.
What to do now
- Find every deployed copy of Petrol Pump Management Software, including test and staging servers and forgotten hosting accounts.
- Record the version of each copy. The record covers 1.0.
- Check the vendor or project page for a fixed release. We could not confirm one, so do not assume it exists.
- If the application does not need to be public, move it behind a VPN or an allow list of known addresses now.
- If you can maintain the source, accept only an allow list of file types, check content as well as the file name, store uploads outside the web root or in a location the server never executes, and rename files on save.
- If the software is not essential and nobody maintains it, plan to retire or replace it. Unmaintained sample style projects are poor homes for real data.
Why it matters
An unrestricted upload means the application accepts a file from a user without enough checks on its type, content or final location. The risk depends on where the file lands and whether the web server will run or serve it. The record says only that the manipulation of photo leads to unrestricted upload. It does not say what an uploaded file can do on a real deployment, so we will not guess beyond the weakness class.
A note on severity. The record's description text, taken from the VulDB entry, calls this issue critical. The CVSS 3.1 base score attached to the record is 4.7, which is medium, with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. Both are accurate descriptions of the same record on different scales. For triage we rely on the CVSS score and on how exposed your own deployment is. VulDB publishes its own scoring, which we could not retrieve.
CVE-2024-2058 is not on the CISA Known Exploited Vulnerabilities list. The description does say the exploit has been disclosed to the public and may be used, which means technical detail is available to anyone who looks. That is a reason to act on exposed copies, even though the sources we could read record no exploitation.
Quick check
Is CVE-2024-2058 known to be exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list, and the sources we could read do not report exploitation. The record does say a public exploit exists, so do not wait for confirmation.
Is there a fixed version of Petrol Pump Management Software?
The record does not name one. Check the vendor or project, and if none exists, restrict access or retire the software.
Sources
- Gold entry for CVE-2024-2058
- NVD record for CVE-2024-2058 (description, CVSS vector, CWE and publication date), as held in the Safeguard record set. The linked VulDB entry VDB-255373 and the researcher write up were referenced by the record but could not be retrieved.
Last reviewed: 19 October 2026.
