CVE-2024-33967 is a high-severity SQL injection vulnerability affecting multiple Janobe products, including PayPal, Credit Card, Debit Card Payment, School Attendance Monitoring System, and School Event Management System, specifically in version 1.0. An unauthenticated attacker can exploit this flaw remotely by injecting malicious SQL queries into the 'view' and 'YearLevel' parameters within the /AttendanceMonitoring/report/attendance_print.php endpoint, leading to the unauthorized disclosure of sensitive database information. While the CVSS score is 7.5 (High), there is currently no public exploit code available, no evidence of active exploitation, and minimal community discussion or media coverage surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0CPE matchmatch criteria | cpe:2.3:a:janobe:credit_card:1.0:*:*:*:*:*:*:* | ||
1.0CPE matchmatch criteria | cpe:2.3:a:janobe:debit_card_payment:1.0:*:*:*:*:*:*:* | ||
1.0CPE matchmatch criteria | cpe:2.3:a:janobe:paypal:1.0:*:*:*:*:*:*:* | ||
1.0CPE matchmatch criteria | cpe:2.3:a:janobe:school_attendence_monitoring_system:1.0:*:*:*:*:*:*:* | ||
1.0CPE matchmatch criteria | cpe:2.3:a:janobe:school_event_management_system:1.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.