CVE-2024-33966: Janobe Credit Card SQLi Vulnerability

CVE-2024-33966 Overview

CVE-2024-33966 is a SQL injection vulnerability [CWE-89] affecting Janobe PayPal, Credit Card, and Debit Card Payment version 1.0, along with related Janobe School Attendance Monitoring System and School Event Management System products. The flaw resides in the xtsearch parameter of /admin/mod_reports/index.php. An unauthenticated attacker can submit a crafted query through this parameter and exfiltrate arbitrary data from the backend database. The vulnerability requires no privileges or user interaction and is exploitable over the network.

Critical Impact
Unauthenticated remote attackers can extract all data stored in the application database, including administrator credentials, payment records, and customer information.

Affected Products

Janobe PayPal 1.0
Janobe Credit Card 1.0 and Janobe Debit Card Payment 1.0
Janobe School Attendance Monitoring System 1.0 and School Event Management System 1.0

Discovery Timeline

2024-08-06 - CVE-2024-33966 published to NVD
2024-08-08 - Last updated in NVD database

Technical Details for CVE-2024-33966

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements used in a SQL command [CWE-89]. The administrative reporting endpoint at /admin/mod_reports/index.php accepts user-controlled input through the xtsearch GET parameter and concatenates it directly into a SQL query. Because the input is not parameterized or sanitized, attackers can break out of the intended query context and append arbitrary SQL clauses.

The vulnerability impacts confidentiality of stored data. An attacker can read records across all tables accessible to the application's database user. The CWE-89 classification confirms that the root cause is missing input validation at the database query layer rather than a downstream authentication or session flaw.

The EPSS score is 0.175% as of 2026-06-09, indicating low observed exploitation activity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The xtsearch parameter handler in /admin/mod_reports/index.php constructs a SQL query through direct string concatenation. The application does not use prepared statements, parameter binding, or input sanitization. Any value supplied in xtsearch becomes part of the executed SQL statement.

Attack Vector

An attacker sends an HTTP request to /admin/mod_reports/index.php with a malicious payload in the xtsearch parameter. Typical exploitation uses UNION SELECT statements or boolean-based blind techniques to enumerate tables and extract row data. No authentication is enforced on the vulnerable code path according to the advisory.

No verified proof-of-concept code is publicly available. See the INCIBE CERT Notice on Janobe Vulnerabilities for additional technical context.

Detection Methods for CVE-2024-33966

Indicators of Compromise

HTTP requests to /admin/mod_reports/index.php containing SQL keywords such as UNION, SELECT, SLEEP, INFORMATION_SCHEMA, or comment markers (--, #, /*) in the xtsearch parameter.
Web server logs showing unusually long query strings or encoded payloads (%27, %20OR%20, 0x) targeting the xtsearch parameter.
Database error messages returned to clients referencing syntax errors near the reports module.

Detection Strategies

Deploy a web application firewall ruleset for SQL injection signatures, prioritizing requests to /admin/mod_reports/.
Enable database query logging and alert on UNION SELECT or INFORMATION_SCHEMA queries originating from the application user.
Correlate web access logs with database audit logs to identify requests that trigger anomalous query patterns.

Monitoring Recommendations

Monitor outbound traffic from the database host for large or unexpected data transfers that could indicate exfiltration.
Alert on repeated failed query attempts followed by successful queries against sensitive tables.
Track HTTP 500 responses from the reports module, which often indicate injection probing.

How to Mitigate CVE-2024-33966

Immediate Actions Required

Restrict network access to /admin/ paths to trusted administrative IP ranges using firewall or reverse proxy rules.
Place affected Janobe applications behind a web application firewall with SQL injection signatures enabled.
Audit the application database for unauthorized access and rotate all stored credentials, API keys, and payment tokens.

Patch Information

No vendor patch is referenced in the available advisory data. Refer to the INCIBE CERT Notice on Janobe Vulnerabilities for vendor communication and remediation status. Organizations using Janobe version 1.0 products should consider discontinuing use until a fixed release is available.

Workarounds

Modify the application source to replace concatenated SQL in /admin/mod_reports/index.php with parameterized queries or prepared statements.
Apply server-side input validation on the xtsearch parameter to allow only expected character classes.
Run the application database account with least privilege so it cannot read sensitive tables outside the reports scope.

bash

# Example ModSecurity rule to block SQLi against the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /admin/mod_reports/index.php" \
  "chain,phase:2,deny,status:403,id:1003396,msg:'Block SQLi attempt on xtsearch (CVE-2024-33966)'"
  SecRule ARGS:xtsearch "@detectSQLi" "t:none,t:urlDecodeUni"