CVE-2024-24023
📋 TL;DR
A SQL injection vulnerability in Novel-Plus v4.3.0-RC1 and earlier allows attackers to inject malicious SQL commands via offset, limit, and sort parameters in the /novel/bookContent/list endpoint. This can lead to unauthorized database access, data theft, or system compromise. All users running affected versions are vulnerable.
💻 Affected Systems
- Novel-Plus
📦 What is this software?
Novel Plus by Xxyopen
Novel Plus by Xxyopen
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, or remote code execution on the underlying server.
Likely Case
Unauthorized access to sensitive data stored in the database, such as user credentials, personal information, or proprietary content.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented, potentially only causing errors or minor data exposure.
🎯 Exploit Status
Exploitation is straightforward via crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check the official GitHub repository for updates or patches. Upgrade to a version beyond v4.3.0-RC1 if available.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and sanitization for offset, limit, and sort parameters in the /novel/bookContent/list endpoint.
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block SQL injection patterns in HTTP requests targeting the vulnerable endpoint.
🧯 If You Can't Patch
- Restrict network access to the Novel-Plus application to trusted IPs only.
- Monitor and log all access to the /novel/bookContent/list endpoint for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Test the /novel/bookContent/list endpoint with SQL injection payloads in offset, limit, or sort parameters and observe database errors or unexpected behavior.Check Version:
Check the application version in the Novel-Plus admin panel or configuration files.Verify Fix Applied:
After applying fixes, retest with SQL injection payloads to ensure no database errors or unauthorized access occurs.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- HTTP requests to /novel/bookContent/list with suspicious parameters containing SQL keywords like UNION, SELECT, or --
Network Indicators:
- HTTP traffic to /novel/bookContent/list with parameters containing SQL injection patterns
SIEM Query:
source="novel-plus.logs" AND (url_path="/novel/bookContent/list" AND (param="offset" OR param="limit" OR param="sort") AND (value="*UNION*" OR value="*SELECT*" OR value="*--*"))