CVE-2024-33980: Janobe Credit Card XSS Vulnerability

CVE-2024-33980 Overview

CVE-2024-33980 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Janobe PayPal, Credit Card, and Debit Card Payment version 1.0. The flaw resides in the start parameter of the /admin/mod_reports/printreport.php endpoint. An attacker can craft a malicious URL and deliver it to an authenticated administrator. When the victim visits the link, arbitrary JavaScript executes in the browser under the application's origin. Successful exploitation can lead to session cookie theft and hijacking of the administrator session.

Critical Impact
Attackers can steal administrator session cookies through a crafted URL, enabling account takeover of the payment module.

Affected Products

Janobe PayPal 1.0
Janobe Credit Card 1.0
Janobe Debit Card Payment 1.0

Discovery Timeline

2024-08-06 - CVE-2024-33980 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33980

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the administrative reporting component of Janobe's payment modules. The printreport.php script accepts a start parameter through the URL query string. The application echoes this value back into the rendered HTML response without proper output encoding or input sanitization. As a result, attacker-supplied JavaScript executes within the administrator's browser session.

Because the payload runs in the origin of the vulnerable application, it can access the document.cookie object and exfiltrate session identifiers. The scope change reflected in the CVSS vector indicates the impact extends beyond the vulnerable component itself. Exploitation requires user interaction — the victim must click or otherwise load the crafted URL.

Root Cause

The root cause is missing input validation and output encoding on the start GET parameter processed by /admin/mod_reports/printreport.php. User-controlled data is written directly into the HTML response context, allowing a browser to interpret injected markup and script content as trusted code.

Attack Vector

Exploitation follows a standard reflected XSS pattern. An attacker crafts a URL that includes a JavaScript payload in the start query parameter. The attacker then delivers the URL through phishing email, chat, or a link on a controlled site. When an authenticated administrator loads the URL, the payload executes and can transmit document.cookie values to an attacker-controlled endpoint. The attacker can then replay the session cookie to impersonate the administrator.

No proof-of-concept exploit is publicly listed in Exploit-DB, and the vulnerability is not tracked on the CISA KEV list. Refer to the INCIBE Security Notice for Janobe for the coordinated disclosure details.

Detection Methods for CVE-2024-33980

Indicators of Compromise

Web server access logs containing requests to /admin/mod_reports/printreport.php with HTML tags, <script>, onerror=, or URL-encoded equivalents (%3Cscript%3E) in the start parameter.
Outbound HTTP requests from administrator browsers to unfamiliar domains carrying cookie values in query strings or POST bodies.
Administrator sessions originating from unexpected IP addresses or geolocations shortly after clicking an external link.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query parameters on printreport.php for XSS signatures and block or alert on matches.
Enable Content Security Policy (CSP) reporting to capture inline script violations that indicate injection attempts.
Correlate email gateway telemetry with web proxy logs to identify inbound URLs targeting the vulnerable endpoint.

Monitoring Recommendations

Review authentication logs for concurrent administrator sessions or session token reuse across different source addresses.
Alert on any HTTP 200 response from printreport.php where the request contains reflected script content.
Monitor administrator browser endpoints for anomalous outbound connections following visits to the payment application.

How to Mitigate CVE-2024-33980

Immediate Actions Required

Restrict access to the /admin/ directory using network-level controls, IP allowlists, or VPN-only access.
Invalidate all active administrator sessions and require re-authentication after applying protective controls.
Communicate the phishing risk to administrative users and instruct them not to open reporting URLs from untrusted sources.

Patch Information

No vendor patch is listed in the CVE record or referenced advisories at the time of publication. Consult the INCIBE Security Notice for Janobe for updates from the vendor. Organizations running Janobe 1.0 payment modules should treat the software as unsupported until a fixed release is confirmed.

Workarounds

Configure a WAF rule to reject requests to /admin/mod_reports/printreport.php where the start parameter contains <, >, ", ', or script.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of cookie theft via JavaScript.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Consider replacing the affected payment module with a maintained alternative if the vendor does not publish a fix.

bash

# Example Nginx configuration to harden cookies and block suspicious start parameters
add_header Set-Cookie "PHPSESSID=$cookie_PHPSESSID; HttpOnly; Secure; SameSite=Strict";
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';";

location /admin/mod_reports/printreport.php {
    if ($arg_start ~* "(<|>|script|onerror|onload|javascript:)") {
        return 403;
    }
}