xxyopen/201206030 novel-plus up to 5.1.3 CATCHA LoginController.java ajaxLogin authentication replay

Summaryinfo

A vulnerability labeled as critical has been found in xxyopen/201206030 novel-plus up to 5.1.3. This impacts the function ajaxLogin of the file novel-admin/src/main/java/com/java2nb/system/controller/LoginController.java of the component CATCHA Handler. Such manipulation leads to authentication replay. This vulnerability is uniquely identified as CVE-2025-6533. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

Detailsinfo

A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin of the file novel-admin/src/main/java/com/java2nb/system/controller/LoginController.java of the component CATCHA Handler. The manipulation with an unknown input leads to a authentication replay vulnerability. Using CWE to declare the problem leads to CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). Impacted is confidentiality, integrity, and availability.

The advisory is shared for download at blog.0xd00.com. This vulnerability is handled as CVE-2025-6533. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1040.

The exploit is available at blog.0xd00.com. It is declared as proof-of-concept. The vendor was contacted early about this disclosure but did not respond in any way.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-18961). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• 201206030
• xxyopen

Name

• novel-plus

Version

• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #596481: xxyopen novel-plus 5.1.3 Improper Restriction of Excessive Authentication Attempts (by bpy9ft)

Once again VulDB remains the best source for vulnerability data.

Discussion