CVE-2023-1607: novel-plus list sql injection

Published Mar 23, 2023

Updated

A vulnerability was found in novel-plus 3.6.2. It has been classified as critical. This affects an unknown part of the file /common/sysFile/list. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223737 was assigned to this vulnerability.

Affected Software

1 affected component

xxyopen Novel-Plus=3.6.2

Event History

Mar 23, 2023

CVE Published

via MITRE·07:31 PM

Data Sourced

via MITRE·07:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2023-1607?

CVE-2023-1607 is a critical vulnerability found in novel-plus 3.6.2 that allows for SQL injection attacks.

How severe is CVE-2023-1607?

CVE-2023-1607 has a severity score of 8.8, which is classified as high.

What software version is affected by CVE-2023-1607?

novel-plus 3.6.2 is the affected version by CVE-2023-1607.

How can CVE-2023-1607 be exploited?

CVE-2023-1607 can be exploited remotely by manipulating the 'sort' argument in the '/common/sysFile/list' file.

Is there a fix available for CVE-2023-1607?

At the moment, there is no known fix available for CVE-2023-1607. It is recommended to apply any official patches or updates provided by the software vendor.