CVE-2024-33963: Janobe Credit Card SQLi Vulnerability

CVE-2024-33963 Overview

CVE-2024-33963 is a SQL injection vulnerability [CWE-89] affecting Janobe PayPal, Credit Card and Debit Card Payment version 1.0. The flaw resides in the id parameter of the /admin/mod_room/index.php endpoint. An unauthenticated attacker can submit a crafted query string to manipulate the underlying SQL statement. Successful exploitation allows the attacker to read arbitrary data from the application database. The vulnerability also extends to related Janobe products that share the same codebase, including the School Attendance Monitoring System and the School Event Management System.

Critical Impact
Unauthenticated attackers can extract the entire contents of the backend database, including administrator credentials and payment-related records, by sending a single crafted HTTP request.

Affected Products

Janobe PayPal 1.0
Janobe Credit Card 1.0 and Debit Card Payment 1.0
Janobe School Attendance Monitoring System 1.0 and School Event Management System 1.0

Discovery Timeline

2024-08-06 - CVE-2024-33963 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33963

Vulnerability Analysis

The vulnerability is a classic in-band SQL injection in the administrative interface of multiple Janobe PHP applications. The id GET parameter passed to /admin/mod_room/index.php is concatenated directly into a SQL query without parameterization or input validation. An attacker can append UNION-based or boolean-based payloads to the parameter to alter the query logic. The injection runs in the database context used by the web application, granting read access to every table the application can reach. Because the vulnerable endpoint is reachable over the network and requires no authentication or user interaction, exploitation is straightforward with common tooling such as sqlmap.

Root Cause

The root cause is the absence of prepared statements and input sanitization when handling the id parameter. User-supplied data is interpolated into the SQL statement as a literal string fragment. PHP code in the affected module trusts the request parameter and does not apply type casting, allow-listing, or parameter binding before query execution.

Attack Vector

Attackers reach the flaw remotely by issuing HTTP requests to the administrative path. The payload is delivered through the URL query string, and the server returns data either in the response body or through inferential side channels. The vulnerability falls under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. The published advisory from INCIBE confirms exploitation through the id parameter on the targeted PHP page.

Detection Methods for CVE-2024-33963

Indicators of Compromise

HTTP requests to /admin/mod_room/index.php containing SQL meta-characters such as ', --, UNION SELECT, or SLEEP( inside the id parameter.
Web server access logs showing repeated requests to the same endpoint with incrementally changing id values, indicating automated probing.
Database error messages or unusually large response payloads from the administrative module appearing in application logs.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection signatures targeting the /admin/mod_room/ path.
Enable database query logging and alert on queries against the mod_room table that contain UNION, INFORMATION_SCHEMA, or boolean tautologies like OR 1=1.
Correlate web access logs with database audit trails to identify request-to-query patterns consistent with injection.

Monitoring Recommendations

Forward web server, PHP error, and database logs to a central analytics platform and retain them for retrospective hunting.
Monitor for spikes in 500-series responses or anomalous response sizes from administrative endpoints.
Track outbound data volumes from the database host to detect bulk extraction following a successful injection.

How to Mitigate CVE-2024-33963

Immediate Actions Required

Restrict network access to the /admin/ directory to trusted management networks or via VPN until a fix is applied.
Audit the affected Janobe applications for unauthorized administrative accounts and reset credentials stored in the database.
Place a WAF in blocking mode in front of the application with SQL injection rules enabled.

Patch Information

No vendor patch is referenced in the NVD entry or the INCIBE advisory for multiple Janobe product vulnerabilities. Operators of the affected version 1.0 products should treat the software as unmaintained and plan migration to a supported alternative.

Workarounds

Rewrite the vulnerable query in /admin/mod_room/index.php to use parameterized statements via PDO or mysqli prepared statements, and cast id to an integer before use.
Apply server-side input validation that rejects any non-numeric value for the id parameter and returns an HTTP 400 response.
Remove or rename the administrative module if it is not required for production operation, and disable directory listing on the web server.

bash

# Example Apache rule to block non-numeric id values on the vulnerable endpoint
<LocationMatch "^/admin/mod_room/index\.php$">
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (^|&)id=([^0-9&]|%) [NC]
    RewriteRule ^ - [F,L]
</LocationMatch>