CVE-2025-3856
📋 TL;DR
This is a critical SQL injection vulnerability in xxyopen Novel-Plus 5.1.0 that allows remote attackers to execute arbitrary SQL commands via the 'sort' parameter in the /book/searchByPage endpoint. Attackers can potentially read, modify, or delete database content. All systems running the vulnerable version are affected.
💻 Affected Systems
- xxyopen Novel-Plus
📦 What is this software?
Novel Plus by Xxyopen
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, or full system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation through database manipulation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Public exploit code is available, making this easily exploitable by attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the /book/searchByPage endpoint and 'sort' parameter.
Input Validation Filter
allAdd server-side input validation to reject malicious 'sort' parameter values containing SQL keywords or special characters.
🧯 If You Can't Patch
- Isolate the vulnerable system behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Check if Novel-Plus version is 5.1.0 and test the /book/searchByPage endpoint with SQL injection payloads in the 'sort' parameter.Check Version:
Check application configuration files or admin panel for version information.Verify Fix Applied:
Test the endpoint with SQL injection payloads after implementing fixes; successful payloads should be blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts following SQL injection patterns
- Database error messages containing SQL syntax
Network Indicators:
- HTTP requests to /book/searchByPage with SQL keywords in parameters
- Unusual database connection patterns from application server
SIEM Query:
source="web_logs" AND uri="/book/searchByPage" AND (param="sort" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|exec|--|#)")