CVE-2023-1594
📋 TL;DR
This critical SQL injection vulnerability in novel-plus 3.6.2 allows remote attackers to execute arbitrary SQL commands via the 'sort' parameter in the MenuService function. Attackers can potentially read, modify, or delete database content, and in some cases achieve remote code execution. All systems running vulnerable versions of novel-plus are affected.
💻 Affected Systems
- novel-plus
📦 What is this software?
Novel Plus by Xxyopen
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, and potential remote code execution on the underlying server.
Likely Case
Database information disclosure, privilege escalation, and unauthorized data manipulation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Public proof-of-concept exploit is available, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check for official updates from novel-plus developers. If available, upgrade to a patched version. Otherwise, implement workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for the 'sort' parameter to only allow expected values
Modify sys/menu/list to validate sort parameter against whitelist
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: deny requests containing SQL keywords in sort parameter
🧯 If You Can't Patch
- Implement network segmentation to isolate novel-plus from critical systems
- Enable detailed SQL query logging and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Test the sys/menu/list endpoint with SQL injection payloads in the sort parameterCheck Version:
Check novel-plus version in application configuration or admin panelVerify Fix Applied:
Test with SQL injection payloads and verify they are rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts following SQL injection patterns
Network Indicators:
- HTTP requests with SQL keywords in sort parameter
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="*/sys/menu/list*" AND (param="sort" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|--|#)")