CVE-2024-33962: Janobe Credit Card SQLi Vulnerability

CVE-2024-33962 Overview

CVE-2024-33962 is a SQL injection vulnerability affecting Janobe PayPal, Credit Card and Debit Card Payment version 1.0. The flaw resides in the code parameter of /admin/mod_reservation/index.php. An unauthenticated attacker can send specially crafted queries to the backend database and exfiltrate stored data. The vulnerability maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Related Janobe products including the School Attendance Monitoring System and the School Event Management System share the same vulnerable code paths.

Critical Impact

Unauthenticated attackers can extract the full contents of the application database, including payment-related and administrative records, by injecting SQL through the code parameter.

Affected Products

• Janobe PayPal 1.0, Credit Card 1.0, Debit Card Payment 1.0
• Janobe School Attendance Monitoring System 1.0
• Janobe School Event Management System 1.0

Discovery Timeline

• 2024-08-06 - CVE-2024-33962 published to NVD
• 2024-08-08 - Last updated in NVD database

Technical Details for CVE-2024-33962

Vulnerability Analysis

The vulnerability stems from unsanitized user input passed directly into a SQL query. The code parameter in /admin/mod_reservation/index.php is concatenated into a database query without parameterization or input validation. An attacker reaches this endpoint over the network without authentication and influences the resulting SQL statement.

Because the injection point sits in an administrative reservation module that interacts with persistent storage, an attacker can issue UNION-based or boolean-based payloads to enumerate tables, dump rows, and read arbitrary columns. The flaw applies to multiple Janobe products that share this code base, broadening the exposure across Janobe's payment and school management product line.

Root Cause

The root cause is missing input neutralization at the database query boundary [CWE-89]. The code parameter is interpolated into a SQL string rather than bound as a parameter through a prepared statement. PHP applications using raw mysqli_query or mysql_query without escaping or prepared statements are typical sources of this defect.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker crafts an HTTP request targeting /admin/mod_reservation/index.php and supplies a malicious code value. Tooling such as sqlmap can automate enumeration and extraction once the injection point is confirmed.

No public proof-of-concept code has been published. The vulnerability mechanism is described in the INCIBE Security Notice.

Detection Methods for CVE-2024-33962

Indicators of Compromise

• HTTP requests to /admin/mod_reservation/index.php containing SQL meta-characters such as ', --, UNION, SELECT, SLEEP(, or INFORMATION_SCHEMA in the code parameter.
• Repeated requests from the same source IP with incrementing payload variations indicating automated SQL injection tooling.
• Anomalous response sizes or 500-class errors from the reservation administrative endpoint.

Detection Strategies

• Inspect web server access logs for GET or POST requests to admin/mod_reservation/index.php and decode the code query string parameter for SQLi signatures.
• Deploy a web application firewall in detection mode to flag SQL injection patterns against the affected paths.
• Correlate database error log entries with inbound HTTP traffic to identify failed injection attempts that still indicate active probing.

Monitoring Recommendations

• Alert on user-agents commonly associated with automated scanners such as sqlmap, nikto, or acunetix reaching the administrative module.
• Track outbound traffic from the web host for unexpected bulk responses that may indicate database content exfiltration.
• Baseline normal request volume to /admin/mod_reservation/ and alert on spikes from single source addresses.

How to Mitigate CVE-2024-33962

Immediate Actions Required

• Restrict access to the /admin/ directory by IP allow-list or VPN until a vendor patch is verified.
• Place the application behind a web application firewall with SQL injection rule sets enabled in blocking mode.
• Audit the database account used by the application and revoke privileges beyond the minimum required for application function.

Patch Information

No vendor patch is referenced in the NVD entry or the INCIBE Security Notice at time of publication. Operators of Janobe version 1.0 products should monitor the vendor channel for an updated release and consider replacing affected components if a fix is not made available.

Workarounds

• Modify /admin/mod_reservation/index.php to bind the code parameter using prepared statements with mysqli_prepare or PDO with bindParam.
• Apply server-side input validation that constrains code to an expected character set such as alphanumeric values of a fixed length.
• Disable or remove the reservation administrative module if it is not in active use.

# Example WAF rule (ModSecurity) to block SQLi patterns on the affected endpoint
SecRule REQUEST_URI "@contains /admin/mod_reservation/index.php" \
    "chain,phase:2,deny,status:403,id:1003396,log,msg:'Possible CVE-2024-33962 SQLi'"
    SecRule ARGS:code "@detectSQLi" "t:none,t:urlDecodeUni"