Database Vulnerability Exposes PayPal User Information

CVE-2024-33966

What is CVE-2024-33966?

An SQL injection vulnerability in PayPal’s Credit Card and Debit Card Payment systems exists in version 1.0. This vulnerability allows an attacker to send specially crafted SQL queries to the server, specifically targeting the 'xtsearch' parameter located in the '/admin/mod_reports/index.php' file. If exploited, this could lead to unauthorized access to sensitive data stored in the database. This highlights the necessity for organizations to implement strong input validation and sanitize inputs that interact with databases, particularly in payment processing environments.

References