CVE-2024-33959: Janobe Credit Card SQLi Vulnerability

CVE-2024-33959 Overview

CVE-2024-33959 is a SQL injection vulnerability [CWE-89] affecting Janobe PayPal, Credit Card, and Debit Card Payment version 1.0. The flaw resides in the categ parameter of /admin/mod_reports/printreport.php. An unauthenticated attacker can send a specially crafted query to the vulnerable endpoint and extract data from the backend database. The vulnerability is exploitable over the network without user interaction or privileges.

Critical Impact
Remote unauthenticated attackers can extract the full contents of the application database, including payment-related records and administrative data, by injecting SQL through the categ URL parameter.

Affected Products

Janobe PayPal 1.0
Janobe Credit Card 1.0
Janobe Debit Card Payment 1.0
Janobe School Attendance Monitoring System 1.0
Janobe School Event Management System 1.0

Discovery Timeline

2024-08-06 - CVE-2024-33959 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33959

Vulnerability Analysis

The vulnerability is a classic SQL injection in the administrative reporting module of multiple Janobe products. The endpoint /admin/mod_reports/printreport.php accepts a categ request parameter and concatenates it into a SQL statement without sanitization or parameterization. An attacker controlling categ can break out of the intended query context and append arbitrary SQL clauses.

The flaw is reachable over the network and requires no authentication or user interaction. Because the impacted endpoint is part of the reporting subsystem, attackers can use UNION-based or boolean-based techniques to enumerate tables and exfiltrate stored records. The impact is limited to confidentiality, with integrity and availability unaffected per the CVSS vector.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The printreport.php script trusts the categ parameter from the HTTP request and embeds it directly in a SQL query. The application does not use prepared statements, parameter binding, or input validation, allowing attacker-supplied SQL syntax to alter query semantics.

Attack Vector

An attacker crafts an HTTP request to /admin/mod_reports/printreport.php with a malicious value supplied to the categ parameter. The injected payload can use SQL operators such as UNION SELECT to read arbitrary columns from any table accessible to the database user. Because the endpoint is reachable without authentication, the attack can be automated and conducted at scale against exposed Janobe deployments.

No public proof-of-concept code is referenced in the NVD entry. Refer to the INCIBE Security Notice on Vulnerabilities for additional technical context.

Detection Methods for CVE-2024-33959

Indicators of Compromise

HTTP requests to /admin/mod_reports/printreport.php containing SQL keywords such as UNION, SELECT, SLEEP, INFORMATION_SCHEMA, or comment sequences (--, #, /*) in the categ parameter.
Web server access logs showing repeated requests to printreport.php from a single source with varying categ payload lengths.
Database error messages or unusually long response times correlated with requests to the reporting endpoint.

Detection Strategies

Deploy a web application firewall rule that inspects the categ parameter for SQL metacharacters and known injection patterns.
Enable database query logging and alert on unexpected UNION operations or queries referencing INFORMATION_SCHEMA tables from the web application user.
Correlate web access logs with database audit logs to identify request and query pairs that deviate from baseline reporting behavior.

Monitoring Recommendations

Monitor outbound data volumes from the application server for spikes indicative of bulk data extraction.
Track HTTP 500 responses and SQL syntax errors emitted by printreport.php, which often accompany injection probing.
Review authentication and session activity on the /admin/ path to confirm whether the endpoint is exposed without access controls.

How to Mitigate CVE-2024-33959

Immediate Actions Required

Restrict network access to the /admin/ directory using IP allowlisting or VPN-only access until a vendor patch is available.
Deploy WAF signatures that block SQL injection payloads targeting the categ parameter on /admin/mod_reports/printreport.php.
Audit database logs and application logs for evidence of prior exploitation against the affected endpoint.

Patch Information

No vendor advisory or patch is referenced in the NVD record for CVE-2024-33959. Affected organizations should consult the INCIBE Security Notice on Vulnerabilities and contact the vendor directly for remediation guidance. Where no fix is available, consider replacing the affected component or isolating the application from untrusted networks.

Workarounds

Modify printreport.php to use parameterized queries or prepared statements for all database operations involving the categ parameter.
Apply server-side input validation that restricts categ to an allowlist of expected values such as numeric IDs or known category names.
Run the application database account with least privilege, removing access to tables not required by the reporting module.

bash

# Example ModSecurity rule to block SQL injection attempts against the vulnerable endpoint
SecRule REQUEST_URI "@contains /admin/mod_reports/printreport.php" \
    "chain,id:1003359,phase:2,deny,status:403,log,msg:'CVE-2024-33959 SQLi attempt on categ parameter'"
    SecRule ARGS:categ "@rx (?i)(union\s+select|information_schema|sleep\s*\(|--|/\*|;)"