CVE-2024-24015
📋 TL;DR
A SQL injection vulnerability in Novel-Plus v4.3.0-RC1 and earlier allows attackers to execute arbitrary SQL commands via crafted offset, limit, and sort parameters in the /sys/user/exit endpoint. This can lead to unauthorized data access, modification, or deletion. All users running affected versions are impacted.
💻 Affected Systems
- Novel-Plus
📦 What is this software?
Novel Plus by Xxyopen
Novel Plus by Xxyopen
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, or full system takeover via subsequent attacks.
Likely Case
Unauthorized access to sensitive user data, administrative credentials, or database manipulation.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented.
🎯 Exploit Status
Exploitation requires sending crafted HTTP requests to the vulnerable endpoint with SQL injection payloads in offset, limit, or sort parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v4.3.0-RC2 or later
Vendor Advisory: https://github.com/201206030/novel-plus
Restart Required: Yes
Instructions:
1. Backup your Novel-Plus installation and database. 2. Download the latest version from the official repository. 3. Replace the existing installation with the patched version. 4. Restart the Novel-Plus application server.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns in offset, limit, and sort parameters.
Input Validation Filter
allAdd server-side validation to reject non-numeric values in offset and limit parameters.
🧯 If You Can't Patch
- Block external access to the /sys/user/exit endpoint using network ACLs or web server configuration.
- Implement strict input validation and parameterized queries in the affected code section.
🔍 How to Verify
Check if Vulnerable:
Test by sending a request to /sys/user/exit with SQL injection payloads in offset, limit, or sort parameters and observing database errors or unexpected behavior.Check Version:
Check the Novel-Plus version in the application's admin panel or configuration files.Verify Fix Applied:
After patching, attempt the same SQL injection tests and verify they are rejected or properly handled without database errors.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL syntax errors in application logs
- Multiple requests to /sys/user/exit with suspicious parameter values
- Database error messages containing SQL fragments
Network Indicators:
- HTTP requests to /sys/user/exit containing SQL keywords (UNION, SELECT, etc.) in parameters
- Abnormal database query patterns from the application server
SIEM Query:
source="novel-plus" AND (url_path="/sys/user/exit" AND (param="offset" OR param="limit" OR param="sort") AND value MATCHES "(?i)(union|select|insert|update|delete|drop|--|#|;)")