CVE-2024-33967: Janobe Credit Card SQLi Vulnerability

CVE-2024-33967 Overview

CVE-2024-33967 is a SQL injection vulnerability [CWE-89] affecting Janobe PayPal, Credit Card and Debit Card Payment version 1.0, along with related Janobe applications including the School Attendance Monitoring System and School Event Management System. An unauthenticated attacker can send a crafted query to the view parameter in Attendance and the YearLevel parameter in /AttendanceMonitoring/report/attendance_print.php to retrieve arbitrary data from the backend database. The flaw is remotely exploitable over the network without authentication or user interaction.

Critical Impact

Unauthenticated attackers can extract sensitive data from the backend database by injecting SQL into vulnerable request parameters.

Affected Products

• Janobe PayPal 1.0
• Janobe Credit Card 1.0 and Debit Card Payment 1.0
• Janobe School Attendance Monitoring System 1.0 and School Event Management System 1.0

Discovery Timeline

• 2024-08-06 - CVE-2024-33967 published to NVD
• 2024-08-08 - Last updated in NVD database

Technical Details for CVE-2024-33967

Vulnerability Analysis

The vulnerability resides in the /AttendanceMonitoring/report/attendance_print.php endpoint. The script accepts the view parameter in the Attendance context and the YearLevel parameter without performing input sanitization or parameterized query binding. User-controlled values flow directly into SQL statements executed against the backend database.

An attacker submits a specially crafted HTTP request containing SQL meta-characters. The injected payload alters the structure of the original query, enabling UNION-based extraction, boolean blind techniques, or error-based exfiltration of database contents. Because the vulnerability is in the Janobe payment and school management modules, exposed data may include user credentials, attendance records, and financial transaction details.

The issue is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). Refer to the INCIBE Notice on Janobe Vulnerabilities for additional technical context.

Root Cause

The affected PHP scripts concatenate request parameters directly into SQL queries. No prepared statements, type casting, or escape routines validate the view or YearLevel inputs before query execution.

Attack Vector

Exploitation requires only network access to a vulnerable Janobe deployment. The attacker issues HTTP GET or POST requests with malicious SQL fragments in the targeted parameters. No credentials and no user interaction are needed.

No public proof-of-concept exploit code has been published for this CVE. Technical specifics on the parameter injection points are documented in the INCIBE advisory referenced above.

Detection Methods for CVE-2024-33967

Indicators of Compromise

• HTTP requests to /AttendanceMonitoring/report/attendance_print.php containing SQL meta-characters such as ', UNION SELECT, --, /*, or SLEEP( in the view or YearLevel parameters.
• Web server logs showing repeated requests with encoded payloads (%27, %20OR%20, %23) targeting the print or attendance endpoints.
• Unusual outbound database query volume or errors generated by the application during reconnaissance attempts.

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect query string and POST body parameters for SQL injection signatures targeting the affected paths.
• Enable database query logging and alert on queries containing UNION, INFORMATION_SCHEMA, or stacked statements originating from the Janobe application user.
• Review HTTP access logs for anomalous parameter lengths or non-numeric values in the YearLevel field, which should normally accept a constrained integer.

Monitoring Recommendations

• Forward web server and database logs to a centralized SIEM and correlate authentication-free requests with downstream database errors.
• Baseline normal request patterns to attendance_print.php and alert on deviations such as parameter tampering or rapid sequential probing.

How to Mitigate CVE-2024-33967

Immediate Actions Required

• Restrict network access to the affected Janobe applications until a vendor fix is verified. Place the application behind authenticated VPN or IP allow-lists.
• Deploy WAF signatures that block SQL injection attempts against /AttendanceMonitoring/report/attendance_print.php and related endpoints.
• Audit database accounts used by the application and reduce privileges to the minimum required for normal operation.

Patch Information

No vendor patch or security advisory from Janobe is referenced in the NVD entry at the time of publication. Consult the INCIBE Notice on Janobe Vulnerabilities for the latest vendor remediation status.

Workarounds

• Modify the affected PHP scripts to use parameterized queries or prepared statements via PDO or mysqli_prepare instead of string concatenation.
• Add server-side input validation to enforce expected types and value ranges on the view and YearLevel parameters before they reach SQL execution.
• If the application is not business-critical, take it offline until the code is remediated or replaced with a maintained alternative.