novel-plus sql injection

CVE-2023-2040

What is CVE-2023-2040?

A vulnerability has been identified in novel-plus 3.6.2, where an unknown function in the URL parameter '/news/list?limit=10&offset=0&order=desc' is susceptible to SQL injection due to improper handling of the 'sort' argument. This flaw allows attackers to execute unauthorized SQL commands remotely, potentially compromising the integrity and security of the database. The public disclosure of this vulnerability poses significant risks, and despite attempts to alert the vendor, no response has been received.

References