CVE-2024-33968: Janobe Credit Card SQLi Vulnerability

CVE-2024-33968 Overview

CVE-2024-33968 is a SQL injection vulnerability affecting multiple Janobe products version 1.0, including PayPal, Credit Card and Debit Card Payment, School Attendance Monitoring System, and School Event Management System. The flaw exists in the /AttendanceMonitoring/report/index.php endpoint, where the Attendance and YearLevel parameters are not properly sanitized before being concatenated into SQL queries. An unauthenticated remote attacker can send crafted requests to extract arbitrary data from the backend database. The issue is tracked under CWE-89 and was published to the National Vulnerability Database (NVD) on August 6, 2024.

Critical Impact
Unauthenticated attackers can exfiltrate the complete contents of the application database through crafted HTTP requests over the network.

Affected Products

Janobe PayPal 1.0
Janobe Credit Card 1.0 and Debit Card Payment 1.0
Janobe School Attendance Monitoring System 1.0 and School Event Management System 1.0

Discovery Timeline

2024-08-06 - CVE-2024-33968 published to NVD
2024-08-08 - Last updated in NVD database

Technical Details for CVE-2024-33968

Vulnerability Analysis

The vulnerability resides in the report generation logic at /AttendanceMonitoring/report/index.php. The application accepts user-controlled values through the Attendance and YearLevel HTTP parameters and embeds them directly into SQL statements. Because the parameters are not bound or escaped, an attacker can break out of the original query context and append arbitrary SQL clauses such as UNION SELECT payloads.

Exploitation requires no authentication and no user interaction. The attacker only needs network reachability to the affected web application. Successful exploitation allows extraction of any data accessible to the database user, including credentials, payment records, and student information stored by the monitoring system.

The impact is scoped to confidentiality, with integrity and availability unaffected according to the published vector. INCIBE published a coordinated advisory covering multiple Janobe products in this disclosure batch.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The vulnerable code path concatenates request parameters into query strings without prepared statements, parameterized queries, or input validation against an allow-list of expected values.

Attack Vector

An attacker issues an HTTP request to /AttendanceMonitoring/report/index.php with malicious SQL syntax injected into the Attendance or YearLevel parameters. The backend executes the resulting query and returns data through the application response, enabling techniques such as union-based and boolean-based blind SQL injection. See the INCIBE Security Notice for the full disclosure.

Detection Methods for CVE-2024-33968

Indicators of Compromise

HTTP requests to /AttendanceMonitoring/report/index.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the Attendance or YearLevel parameters.
Web server logs showing unusually long query strings or repeated parametric variations against the report endpoint.
Database error messages or HTTP 500 responses originating from the report module.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL injection patterns targeting the Attendance and YearLevel parameters.
Enable database query logging and alert on UNION, INFORMATION_SCHEMA, or stacked-query patterns originating from the application service account.
Correlate web server access logs with database audit logs to identify single requests that generate anomalous query volume.

Monitoring Recommendations

Monitor outbound data volumes from the database tier for unexpected spikes that may indicate bulk exfiltration.
Track failed and successful authentication attempts following any suspicious request to the report endpoint.
Forward web, application, and database logs to a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2024-33968

Immediate Actions Required

Restrict network access to the affected Janobe applications using firewall rules or VPN gating until a fix is available.
Place the application behind a WAF configured with SQL injection rule sets, blocking requests containing SQL syntax in the Attendance and YearLevel parameters.
Audit database logs for prior exploitation indicators and rotate any credentials stored in the affected database.

Patch Information

No vendor patch is referenced in the NVD entry or the INCIBE advisory at the time of publication. Operators should monitor the INCIBE Security Notice and vendor channels for remediation guidance.

Workarounds

Apply server-side input validation that constrains Attendance and YearLevel to an allow-list of expected values such as integers or enumerated codes.
Refactor the report query to use parameterized statements or prepared statements with bound parameters.
Run the database account used by the application with least privilege, removing access to tables and schemas not required for report generation.

bash

# Example ModSecurity rule to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /AttendanceMonitoring/report/index.php" \
  "phase:2,deny,status:403,id:1003396,\
   chain,msg:'Possible SQLi against Janobe report endpoint (CVE-2024-33968)'"
  SecRule ARGS:Attendance|ARGS:YearLevel \
    "@detectSQLi" "t:none,t:urlDecodeUni"