CVE-2024-24021: SQL Injection
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/userFeedback/list.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24021?
CVE-2024-24021 is rated as a critical vulnerability due to its potential to allow unauthorized database access.
How do I fix CVE-2024-24021?
To mitigate CVE-2024-24021, you should update to the latest version of Novel-Plus, ensuring all parameters are properly sanitized.
What systems are affected by CVE-2024-24021?
CVE-2024-24021 affects Novel-Plus versions up to 4.2.0 and version 4.3.0-RC1.
What type of vulnerability is CVE-2024-24021?
CVE-2024-24021 is a SQL injection vulnerability which allows attackers to manipulate SQL queries.
How can attackers exploit CVE-2024-24021?
Attackers can exploit CVE-2024-24021 by sending specially crafted offset, limit, and sort parameters to the user feedback list endpoint.