CVE-2025-3676
📋 TL;DR
This critical SQL injection vulnerability in xxyopen Novel-Plus allows attackers to manipulate database queries through the /api/front/search/books endpoint. Remote attackers can potentially read, modify, or delete database content. All users running Novel-Plus 3.5.0 are affected.
💻 Affected Systems
- xxyopen Novel-Plus
📦 What is this software?
Novel Plus by Xxyopen
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, or potential remote code execution if database permissions allow.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
Public exploit code is available, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for the 'sort' parameter to only allow expected values
WAF Rule
allDeploy web application firewall rules to block SQL injection patterns targeting the /api/front/search/books endpoint
🧯 If You Can't Patch
- Restrict network access to the Novel-Plus application to trusted IP addresses only
- Implement database user with minimal permissions (read-only if possible) for the application
🔍 How to Verify
Check if Vulnerable:
Test the /api/front/search/books endpoint with SQL injection payloads in the 'sort' parameter and observe database errors or unexpected behaviorCheck Version:
Check Novel-Plus version in application configuration or admin panelVerify Fix Applied:
Test with SQL injection payloads and verify they are rejected or sanitized without affecting database operations📡 Detection & Monitoring
Log Indicators:
- Unusual SQL syntax in request parameters
- Database error messages in application logs
- Multiple rapid requests to /api/front/search/books
Network Indicators:
- SQL keywords in HTTP POST/GET parameters
- Unusual database query patterns from application server
SIEM Query:
source="novel-plus-logs" AND (url_path="/api/front/search/books" AND (param="sort" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "--"))