CVE-2024-33964 Overview
CVE-2024-33964 is a SQL injection vulnerability [CWE-89] affecting Janobe PayPal, Credit Card and Debit Card Payment version 1.0. The flaw resides in the id parameter of the /admin/mod_users/index.php endpoint. An unauthenticated attacker can send a specially crafted query to the server and retrieve all data stored in the backend database. INCIBE published the advisory covering multiple Janobe products affected by similar input validation failures.
Critical Impact
Unauthenticated remote attackers can extract the entire contents of the application database, including administrative credentials and payment-related records, by injecting SQL through the id parameter.
Affected Products
- Janobe PayPal 1.0
- Janobe Credit Card 1.0
- Janobe Debit Card Payment 1.0
- Janobe School Attendance Monitoring System 1.0
- Janobe School Event Management System 1.0
Discovery Timeline
- 2024-08-06 - CVE-2024-33964 published to NVD
- 2024-08-08 - Last updated in NVD database
Technical Details for CVE-2024-33964
Vulnerability Analysis
The vulnerability stems from improper neutralization of user-supplied input in a SQL query. The id parameter passed to /admin/mod_users/index.php is concatenated directly into a SQL statement without parameterization or input validation. An attacker can append SQL syntax to alter query semantics, exfiltrate database contents using UNION SELECT techniques, or extract data character-by-character with boolean and time-based blind injection methods.
The vulnerable endpoint resides under the /admin/ path, but exploitation does not require authentication based on the advisory. This expands the attack surface to any network-reachable instance of the application. The impact is bounded to confidentiality of stored data, with no direct integrity or availability consequences reported.
Root Cause
The root cause is the absence of prepared statements or input sanitization when handling the id query parameter. The application passes the value directly into a SQL query string, allowing attacker-controlled SQL fragments to be interpreted as part of the query.
Attack Vector
Exploitation occurs remotely over HTTP. An attacker sends a crafted GET request to /admin/mod_users/index.php with a malicious id parameter value containing SQL syntax. Tooling such as sqlmap can automate detection and data extraction against the endpoint. Refer to the INCIBE Security Notice for the original advisory.
Detection Methods for CVE-2024-33964
Indicators of Compromise
- HTTP requests to /admin/mod_users/index.php containing SQL keywords such as UNION, SELECT, SLEEP, AND 1=1, or encoded variants in the id parameter.
- Unusual database query latency or sustained errors originating from the mod_users module.
- Outbound responses containing schema metadata, hashed credentials, or large row counts returned from administrative endpoints.
Detection Strategies
- Deploy web application firewall (WAF) signatures that flag SQL syntax in query string parameters targeting mod_users/index.php.
- Enable database query logging and alert on queries referencing information_schema or mysql.user originating from the application service account.
- Correlate HTTP access logs with database errors to identify probing patterns consistent with blind SQL injection.
Monitoring Recommendations
- Monitor administrative URL paths for anomalous request volumes from single source IPs.
- Track failed and successful authentication events on the application immediately following requests to the vulnerable endpoint.
- Forward web server and database logs to a centralized analytics platform for retrospective hunting against known SQL injection payloads.
How to Mitigate CVE-2024-33964
Immediate Actions Required
- Restrict network access to the /admin/ path to trusted management networks or via VPN until a vendor fix is available.
- Deploy WAF rules to block SQL metacharacters and known injection signatures targeting the id parameter.
- Audit existing user and payment records for evidence of unauthorized read access.
Patch Information
No vendor advisory or official patch has been published for Janobe products at the time of writing. Review the INCIBE Security Notice for the latest disclosure status and consider replacing the affected components if vendor remediation is not forthcoming.
Workarounds
- Place the application behind a WAF configured to reject requests containing SQL syntax in numeric parameters.
- Apply server-side input validation in a reverse proxy to enforce that the id parameter contains only integer values.
- Rotate administrative credentials and any secrets stored in the database that may have been exposed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
