| शीर्षक | Novel-PlusV3.6.2 exists SQL Injection |
|---|
| विवरण | novel-plus is a multi-terminal (PC, WAP) reading, full-featured original literature CMS system.
In the list method of the MenuController file, the parameter sort is not processed, resulting in sql injection.Vulnerability in the application background.
The vulnerability was found in the backend, and during the white-box audit, it was discovered that the backend password was weak by default, and the cause was the inability to pre-compile the orderby field using mybatis, and no filtering was done. |
|---|
| स्रोत | ⚠️ https://github.com/OYyunshen/Poc/blob/main/Novel-PlusV3.6.2Sqli.pdf |
|---|
| उपयोगकर्ता | OYyunshen (UID 43586) |
|---|
| सबमिशन | 23/03/2023 08:37 AM (4 साल पहले) |
|---|
| संयम | 23/03/2023 09:55 AM (1 hour later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 223662 [novel-plus 3.6.2 sys/menu/list MenuService sort SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|