SQL Injection Vulnerability in Novel Plus v4.3.0-RC1 and Prior
CVE-2024-24021

9.8CRITICAL

Key Information:

Vendor
Novel
Status
Novel-plus
Vendor
CVE Published:
8 February 2024

Summary

The vulnerability in Novel-Plus allows for SQL injection attacks due to improper handling of user-supplied parameters in the user feedback listing feature. An attacker exploiting this flaw can manipulate the offset, limit, and sort parameters to execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive data or database corruption. This issue affects version 4.3.0-RC1 and previous versions, necessitating immediate attention from users to find the necessary patches or mitigations.

References

https://github.com/201206030/novel-plus
https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/m...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.