CVE-2024-24014
📋 TL;DR
A SQL injection vulnerability in Novel-Plus v4.3.0-RC1 and earlier allows attackers to execute arbitrary SQL commands by manipulating offset, limit, and sort parameters in the /novel/author/list endpoint. This can lead to data theft, modification, or deletion. All users running affected versions are impacted.
💻 Affected Systems
- Novel-Plus
📦 What is this software?
Novel Plus by Xxyopen
Novel Plus by Xxyopen
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, or remote code execution via database functions.
Likely Case
Unauthorized access to sensitive data (user credentials, personal information, novel content) and potential data manipulation.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing exploitation.
🎯 Exploit Status
Exploitation requires sending crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Upgrade to a patched version if available, or apply workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for offset, limit, and sort parameters to reject malicious values.
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block SQL injection patterns targeting the /novel/author/list endpoint.
🧯 If You Can't Patch
- Restrict access to the /novel/author/list endpoint using network ACLs or authentication.
- Monitor logs for unusual SQL queries or parameter manipulation attempts.
🔍 How to Verify
Check if Vulnerable:
Test by sending crafted SQL injection payloads in offset, limit, or sort parameters to /novel/author/list and observe database errors or unexpected behavior.Check Version:
Check the application version in its configuration or via the web interface.Verify Fix Applied:
Verify that SQL injection payloads no longer execute and are properly sanitized or rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL syntax in request parameters
- Database error messages in logs
- High volume of requests to /novel/author/list with suspicious parameters
Network Indicators:
- HTTP requests with SQL keywords (e.g., UNION, SELECT, OR) in offset, limit, or sort parameters
SIEM Query:
source="web_logs" AND uri="/novel/author/list" AND (param="offset" OR param="limit" OR param="sort") AND (value="*UNION*" OR value="*SELECT*" OR value="*OR*" OR value="*--*")