CVE-2024-33966: SQL injection in Janobe products
First published: Tue Aug 06 2024(Updated: )
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'xtsearch' in '/admin/mod_reports/index.php' parameter.
Credit: cve-coordination@incibe.es
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Janobe Credit Card | =1.0 | |
| Janobe Debit Card Payment | =1.0 | |
| Janobe Paypal | =1.0 | |
| Janobe School Attendence Monitoring System | =1.0 | |
| Janobe School Event Management System | =1.0 |
Remedy
There is no reported solution at this time.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-33966?
CVE-2024-33966 is categorized as a high severity SQL injection vulnerability.
How do I fix CVE-2024-33966?
To fix CVE-2024-33966, ensure you update to a version of the affected Janobe products that has patched this vulnerability.
Which software is affected by CVE-2024-33966?
CVE-2024-33966 affects Janobe products including Credit Card, Debit Card Payment, PayPal, School Attendance Monitoring System, and School Event Management System, all on version 1.0.
What type of attack can exploit CVE-2024-33966?
An attacker can exploit CVE-2024-33966 by sending specially crafted SQL queries to the server.
What data could be compromised due to CVE-2024-33966?
Exploitation of CVE-2024-33966 could allow attackers to retrieve sensitive information stored in the database.
- agent/weakness
- agent/author
- agent/references
- agent/description
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/title
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/janobe
- canonical/janobe credit card
- version/janobe credit card/1.0
- canonical/janobe debit card payment
- version/janobe debit card payment/1.0
- canonical/janobe paypal
- version/janobe paypal/1.0
- canonical/janobe school attendence monitoring system
- version/janobe school attendence monitoring system/1.0
- canonical/janobe school event management system
- version/janobe school event management system/1.0