CVE-2024-33960

Name of the Vulnerable Software and Affected Versions Janobe PayPal/Card Payment version 1.0

Description A SQL injection issue affects the payment system, allowing an attacker to send a specially crafted query to the server and retrieve stored information through the end parameter in the "/admin/mod reports/printreport.php" endpoint. This could potentially lead to unauthenticated remote code execution.

Recommendations For version 1.0, update the software to a patched version to fix the SQL injection vulnerability. As a temporary workaround, consider restricting access to the "/admin/mod reports/printreport.php" endpoint to minimize the risk of exploitation. Avoid using the end parameter in the affected endpoint until the issue is resolved.