CVE-2024-57430

The vulnerability exists in the pjActionGetUser function, where the column parameter is directly inserted into the SQL query without proper validation or parameterized query execution (CWE-89). An attacker can submit a crafted HTTP request containing a malicious SQL payload as the column parameter value. This allows modification of the logic of queries executed by the application against the database, leading to unauthorized reading, writing, or modification of data.

An attacker can gain unauthorized access to sensitive data stored in the database (information disclosure), perform privilege escalation through user data manipulation, and directly modify or delete database contents.

Apply patches available from the vendor according to references. Until the fix is implemented, it is recommended to restrict application access exclusively to trusted networks and implement Web Application Firewall rules blocking SQL injection attempts.

PHPJabbers Cinema Booking System v2.0