CVE-2024-33971: Janobe Credit Card SQLi Vulnerability

CVE-2024-33971 Overview

CVE-2024-33971 is a SQL injection vulnerability [CWE-89] affecting multiple Janobe PHP applications at version 1.0, including the PayPal, Credit Card, and Debit Card Payment modules, as well as the School Attendance Monitoring System and School Event Management System. The flaw resides in the username parameter of the /login.php endpoint. An unauthenticated attacker can submit a crafted query over the network to extract arbitrary data from the backend database. The vulnerability requires no authentication, no user interaction, and can be exploited remotely.

Critical Impact
An unauthenticated remote attacker can retrieve the full contents of the backend database by injecting SQL through the username parameter of /login.php.

Affected Products

Janobe PayPal 1.0
Janobe Credit Card 1.0 and Debit Card Payment 1.0
Janobe School Attendance Monitoring System 1.0 and School Event Management System 1.0

Discovery Timeline

2024-08-06 - CVE-2024-33971 published to NVD
2024-08-08 - Last updated in NVD database

Technical Details for CVE-2024-33971

Vulnerability Analysis

The vulnerability is a classic in-band SQL injection in the authentication flow of multiple Janobe products. The /login.php script accepts the username POST parameter and concatenates it directly into a SQL statement that queries the user credential table. Because the parameter is neither parameterized nor sanitized, an attacker can break out of the string context and append arbitrary SQL clauses.

Successful exploitation grants read access to every table the application's database user can reach. Given the affected products handle payment workflows, exposed data may include user credentials, session identifiers, and payment-adjacent records stored by the application. The flaw is exploitable pre-authentication because it sits within the login handler itself.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The username parameter is interpolated into a dynamic SQL query without prepared statements, parameter binding, or input validation. Standard SQL metacharacters such as ', --, and UNION are passed through to the database engine unchanged.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends an HTTP POST request to /login.php with a malicious payload in the username field, typically using boolean-based, error-based, or UNION SELECT techniques to enumerate database contents. Automated tools such as sqlmap can fingerprint and dump the database with minimal manual effort.

No verified public exploit code is published. Refer to the INCIBE Vulnerability Notice for the original advisory describing the affected parameter and endpoint.

Detection Methods for CVE-2024-33971

Indicators of Compromise

POST requests to /login.php containing SQL metacharacters such as ', ", --, /*, ;, or keywords like UNION, SELECT, SLEEP, and BENCHMARK in the username field.
Anomalously long username values or repeated login attempts from a single source IP.
Database error messages returned in HTTP responses from the login flow, indicating error-based injection probing.
Outbound DNS or HTTP callbacks from the database host that correlate with out-of-band SQL injection techniques.

Detection Strategies

Deploy a web application firewall rule set that inspects POST bodies to /login.php and blocks SQL injection signatures.
Enable database query logging and alert on syntactically malformed queries or unexpected UNION statements originating from the login handler.
Correlate authentication failure spikes with payload anomalies in the username parameter using application access logs.

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform and retain them for incident review.
Monitor for unusual data egress from the database server, especially large result sets returned to the web tier outside normal usage patterns.
Track repeated 200-response logins followed by privileged operations from previously unseen source addresses.

How to Mitigate CVE-2024-33971

Immediate Actions Required

Restrict public exposure of the affected Janobe applications until a vendor fix is verified, placing them behind a VPN or IP allowlist.
Deploy WAF rules that block SQL metacharacters in the username parameter of /login.php.
Audit the application database for unauthorized read activity and rotate any credentials stored in the affected database.

Patch Information

No vendor patch is referenced in the NVD record at the time of publication. Consult the INCIBE Vulnerability Notice for vendor coordination status and any future advisories from Janobe.

Workarounds

Replace dynamic SQL in /login.php with parameterized queries or PDO prepared statements that bind the username value.
Apply server-side input validation that rejects non-alphanumeric characters in usernames before they reach the database layer.
Run the application database with a least-privilege account that cannot read tables outside the application's required scope.

bash

# Example WAF rule (ModSecurity) to block SQLi patterns on the login endpoint
SecRule REQUEST_URI "@streq /login.php" \
  "chain,phase:2,deny,status:403,id:1003397,msg:'Possible SQLi in username (CVE-2024-33971)'"
  SecRule ARGS:username "@rx (?i)(union(\s|/\*).*select|--|/\*|;|sleep\(|benchmark\(|'\s*or\s*'1'='1)" \
    "t:none,t:urlDecodeUni"