CVE-2024-4307 is a High (CVSS 8.1) SQL injection in HubBank 1.0.2. The id parameter of five pages under /accounts/ feeds an unprepared query, so a crafted value can retrieve database contents. The record names no fix. Restrict access and check the INCIBE CERT notice.
What's affected
- Product: HubBank 1.0.2.
- Affected pages: /accounts/activities.php, /accounts/view-deposit.php, /accounts/view_cards.php, /accounts/wire-transfer.php and /accounts/wiretransfer-pending.php, all via the id parameter.
- Fixed version: none on record. The INCIBE notice did not load for me.
- Severity: High, CVSS 8.1, low privileges required, high confidentiality and integrity impact.
- Related records: CVE-2024-4306 (file upload) and CVE-2024-4309 (more SQL injection endpoints under /user/), which is covered separately.
- Exploitation: KEV is false.
How to check if you're exposed
Search web server logs for requests to the five pages above where the id value contains characters other than digits, such as quotes or SQL keywords. Normal use passes a number.
Also check the database account the application uses. If it can read every table, then one injectable page exposes everything. Knowing that tells you how bad a breach would be.
What to do now
- Confirm whether HubBank 1.0.2 is deployed anywhere.
- Block public access to the application until the queries are fixed.
- Search logs for non numeric id values on the five listed pages.
- Reduce database account permissions to what the application needs.
- If you maintain the code, switch these queries to prepared statements and validate id as an integer.
Why it matters
The record maps this to CWE-89, SQL injection. The pages concatenate the id into a query. Any value that changes the meaning of the query becomes part of it.
Banking applications raise the stakes because the stored data is financial, and five separate pages sharing the same flaw suggests the query building habit is common across the codebase, so a fix to one page alone would leave the rest open.
Even if this particular program is a demo, the pattern of numeric id parameters feeding raw queries is common and worth checking in your own code.
Quick check
Which parameter is injectable?
The id parameter on five pages under /accounts/, per the record.
Is this the same as CVE-2024-4309?
No. That record covers different pages under /user/. They share the product and weakness.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4307 (published 2024-04-29) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
