CVE-2024-24023
published 2024-02-08CVE-2024-24023: A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform…
PriorityP354critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.62%
45.3th percentile
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/bookContent/list.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xxyopen | novel-plus | <= 4.2.0 | — |
| xxyopen | novel-plus | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-azure, linux-lowlatency, linux-nvidia vulnerabilities
osv·2024-04-23·CVSS 6.8
CVE-2023-24023 linux-azure, linux-lowlatency, linux-nvidia vulnerabilities
linux-azure, linux-lowlatency, linux-nvidia vulnerabilities
Daniele Antonioli discovered that the Secure Simple Pairing and Secure
Connections pairing in the Bluetooth protocol could allow an
unauthenticated user to complete authentication without pairing
credentials. A physically proximate attacker placed between two Bluetooth
devices could use this to subsequently impersonate one of the paired
devices. (CVE-2023-24023)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- JFS file system;
- Netfilter;
(CVE-2024-26581, CVE-2023-52600, CVE-2023-52603)
GHSA
GHSA-g7q9-f2h9-c7v7: A SQL injection vulnerability exists in Novel-Plus v4
ghsa_unreviewed·2024-02-08
CVE-2024-24023 [CRITICAL] CWE-89 GHSA-g7q9-f2h9-c7v7: A SQL injection vulnerability exists in Novel-Plus v4
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset, limit, and sort parameters to perform SQL injection via /novel/bookContent/list.
No detection rules found.
No public exploits indexed.
2024-02-08
Published