CVE-2024-24015

Name of the Vulnerable Software and Affected Versions Novel-Plus versions 4.3.0-RC1 and prior

Description A SQL injection issue exists, allowing an attacker to perform SQL operations by passing crafted offset, limit, and sort parameters via the /sys/user/exit API endpoint.

Recommendations For Novel-Plus versions 4.3.0-RC1 and prior, as a temporary workaround, consider restricting access to the /sys/user/exit API endpoint until a patch is available. Avoid using the offset, limit, and sort parameters in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.