CVE-2024-33960

Summary

CVE-2024-33960 is a newly discovered SQL injection vulnerability affecting PayPal's payment system, specifically versions 1.0 of their credit card and debit card payment modules. An attacker can exploit this vulnerability by crafting a malicious SQL query and sending it to the server through the '/admin/mod_reports/printreport.php' parameter. Successful exploitation allows the attacker to retrieve all data stored in the server, potentially leading to sensitive information leaks or unauthorized access. This vulnerability poses a significant risk to PayPal users and requires immediate attention and patching from the affected parties.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.