CVE-2025-6535 in novel-plus
Summary
by MITRE • 06/24/2025
A vulnerability has been found in xxyopen/201206030 novel-plus up to 5.1.3 and classified as critical. This vulnerability affects the function list of the file novel-admin/src/main/resources/mybatis/system/UserMapper.xml of the component User Management Module. The manipulation of the argument sort/order leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/27/2025
This critical vulnerability resides within the novel-plus web application framework version 5.1.3 and earlier, specifically targeting the User Management Module's UserMapper.xml component. The flaw manifests in the list function where improper input validation allows attackers to manipulate sort and order parameters, creating a direct pathway for sql injection attacks. The vulnerability's classification as critical reflects its severe impact potential, particularly given that the exploit has been publicly disclosed and is actively being used in the wild. The affected file novel-admin/src/main/resources/mybatis/system/UserMapper.xml contains the database query structure that fails to properly sanitize user-supplied sort and order arguments, enabling malicious actors to inject arbitrary sql commands.
The technical execution of this vulnerability follows a classic sql injection pattern where the sort and order parameters are directly incorporated into sql query construction without adequate sanitization or parameterization. When an attacker supplies malicious input through these parameters, the application's sql query execution engine processes the injected commands, potentially allowing unauthorized database access, data exfiltration, or even complete database compromise. The remote attack vector means that exploitation can occur from any network location without requiring local system access or authentication. This vulnerability directly maps to CWE-89 sql injection and aligns with ATT&CK technique T1190 for exploitation of remote services and T1071.004 for application layer protocol usage.
The operational impact of this vulnerability extends beyond simple data theft, as it can enable attackers to escalate privileges, modify user accounts, or extract sensitive information from the underlying database. Given that the vendor has not responded to initial disclosure attempts, organizations running affected versions face heightened risk of exploitation without official patches. The presence of a public exploit increases the attack surface significantly, as security teams cannot rely on the assumption that this vulnerability remains unknown to threat actors. Organizations should immediately assess their deployment status, implement temporary workarounds such as input validation restrictions, and develop incident response procedures to monitor for potential exploitation attempts. The vulnerability demonstrates a critical failure in the application's input handling and database interaction security practices, requiring comprehensive code review and remediation efforts to address the root cause.
The disclosure timeline and vendor inaction create additional security concerns, as organizations may be exposed to active exploitation without immediate remediation options. This scenario represents a typical case of zero-day vulnerability exploitation where the window between discovery and patch availability has been significantly shortened. Security teams must consider implementing network-based detection measures, database activity monitoring, and access control restrictions as interim protective measures while awaiting official vendor patches or community-developed mitigations. The vulnerability's presence in a user management module particularly amplifies risk as it could enable attackers to gain administrative privileges or access sensitive user data. Organizations should also evaluate their overall application security posture and implement more robust input validation mechanisms across similar components to prevent similar vulnerabilities from emerging in other parts of their software ecosystem.