CVE-2025-60298
📋 TL;DR
Novel-Plus up to version 5.2.4 contains a stored XSS vulnerability in the /author/updateIndexName endpoint. Authenticated attackers can inject malicious JavaScript through the indexName parameter, which gets stored and executed when other users view affected book chapters. This affects all Novel-Plus instances running vulnerable versions.
💻 Affected Systems
- Novel-Plus
📦 What is this software?
Novel Plus by Xxyopen
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform account takeovers, redirect users to malicious sites, or deploy malware through the application interface.
Likely Case
Attackers with author accounts will inject malicious scripts to compromise reader accounts, potentially stealing credentials or session data.
If Mitigated
With proper input validation and output encoding, the malicious payloads would be neutralized before execution.
🎯 Exploit Status
Requires authenticated author account; exploitation involves crafting malicious JavaScript payloads in the indexName parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.5 or later
Vendor Advisory: https://github.com/201206030/novel-plus
Restart Required: No
Instructions:
1. Update Novel-Plus to version 5.2.5 or later. 2. Verify the update by checking the version number. 3. No restart required for the application.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize the indexName parameter by removing or encoding special characters.
Output Encoding
allApply proper output encoding when displaying indexName values to prevent script execution.
🧯 If You Can't Patch
- Restrict author account creation and monitor existing author accounts for suspicious activity.
- Implement a web application firewall (WAF) with XSS protection rules to block malicious payloads.
🔍 How to Verify
Check if Vulnerable:
Check if Novel-Plus version is 5.2.4 or earlier by examining the application version in the admin panel or configuration files.Check Version:
Check the application's version.txt file or admin dashboard for version information.Verify Fix Applied:
After updating, verify the version is 5.2.5 or later and test the /author/updateIndexName endpoint with XSS payloads to ensure they are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /author/updateIndexName with JavaScript-like content in parameters
- Multiple failed login attempts followed by successful author login
Network Indicators:
- HTTP requests containing script tags or JavaScript functions in the indexName parameter
SIEM Query:
source="web_server" AND uri="/author/updateIndexName" AND (param="indexName" AND value MATCHES "<script|javascript:|onload=|onerror=")