CVE-2024-24019
📋 TL;DR
A SQL injection vulnerability in Novel-Plus v4.3.0-RC1 and earlier allows attackers to execute arbitrary SQL commands via crafted offset, limit, and sort parameters in the /system/roleDataPerm/list endpoint. This can lead to data theft, modification, or deletion. All users running affected versions are impacted.
💻 Affected Systems
- Novel-Plus
📦 What is this software?
Novel Plus by Xxyopen
Novel Plus by Xxyopen
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, or remote code execution if database functions allow it.
Likely Case
Unauthorized data access, manipulation of database contents, and potential authentication bypass.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
Exploitation requires sending crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Upgrade to a patched version when available. Monitor the official repository for updates.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for offset, limit, and sort parameters to allow only expected values.
Web Application Firewall Rule
allDeploy WAF rules to block SQL injection patterns targeting the /system/roleDataPerm/list endpoint.
🧯 If You Can't Patch
- Restrict network access to the Novel-Plus application to trusted IPs only.
- Disable or block the /system/roleDataPerm/list endpoint if not required.
🔍 How to Verify
Check if Vulnerable:
Test by sending crafted SQL injection payloads in offset, limit, or sort parameters to /system/roleDataPerm/list and observing database errors or unexpected behavior.Check Version:
Check the application version in the admin panel or configuration files.Verify Fix Applied:
Verify that parameterized queries are used and input validation rejects malicious payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL syntax in HTTP request parameters
- Database error messages in application logs
- Multiple requests to /system/roleDataPerm/list with suspicious parameters
Network Indicators:
- HTTP requests to /system/roleDataPerm/list containing SQL keywords like UNION, SELECT, or OR
SIEM Query:
source="web_logs" AND uri="/system/roleDataPerm/list" AND (param="*UNION*" OR param="*SELECT*" OR param="*OR*" OR param="*--*")