PT-2024-25599 · Paypal · Paypal

Rafael Pedrero · Published 2024-08-06 · Updated 2024-11-22 · CVE-2024-33967

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PayPal, Credit Card and Debit Card Payment version 1.0

Description A SQL injection issue affects the payment system, allowing an attacker to send a specially crafted query to the server. This could enable the retrieval of all stored information through the view in Attendance and YearLevel in the /AttendanceMonitoring/report/attendance print.php parameter.

Recommendations For version 1.0, consider disabling the /AttendanceMonitoring/report/attendance print.php endpoint until a patch is available to prevent exploitation. Restrict access to the view in Attendance and YearLevel parameters to minimize the risk of information retrieval. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-33967

Affected Products

Paypal

References · 6

• https://osv.dev/vulnerability/CVE-2024-33967 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-33967 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products · Note
• https://twitter.com/G00BYDOOBY/status/1860064492190830717 · Twitter Post
• https://t.me/cvenotify/89402 · Telegram Post
• https://t.me/cvedetector/2563 · Telegram Post