PT-2023-17112 · Unknown · Novel-Plus
CVSS v2.0
6.5
Média
| Vetor | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
novel-plus version 3.6.2
Description
A critical issue affects some unknown functionality of the file DictController.java. The manipulation of the
orderby argument leads to SQL injection. The attack can be launched remotely.Recommendations
For novel-plus version 3.6.2, consider restricting access to the DictController.java file or disabling the
orderby argument to minimize the risk of SQL injection until a patch is available.Exploit
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Novel-Plus