External risk intelligence

Novel-Plus SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-37847

Novel-plus is a web-based application designed for online reading and content management. As a web application, it is commonly deployed as a public-facing service accessible via the internet, making its web interface and associated database endpoints typical targets for network-based interaction.

SQL Injection

Xxyopen Novel Plus

3.6.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical SQL injection vulnerability has been identified in the novel-plus application, which is used for online reading and content management. This flaw could allow unauthorized individuals to access or manipulate sensitive information within the application's database, impacting data integrity and confidentiality. The main concern is confirming the relevance and exposure of this vulnerability within our environment.

Allows attackers to manipulate application data.
Critical vulnerability impacts data confidentiality and integrity.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests over the network to a vulnerable instance of novel-plus. This could allow them to manipulate database queries, potentially leading to unauthorized access, modification, or deletion of data.

No authentication required.
Send malicious SQL queries.
Data compromise and system control.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in novel-plus could allow an unauthenticated attacker to execute arbitrary SQL commands. This could potentially impact the integrity and availability of the application's data when accessed over a network.

Application data could be affected.
SQL commands could be injected remotely.
Unauthorized data access or modification may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that novel-plus is a web application, the primary responsibility likely falls to the application owners or the platform team managing its deployment. The initial step is to confirm the presence of novel-plus, assess its accessibility and criticality, and identify the specific owner responsible for its operation and maintenance. This will inform a risk-based remediation plan, potentially involving vendor coordination or temporary mitigations if immediate patching isn't feasible.

Application or platform teams own the issue.
Verify novel-plus reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is novel-plus?

Novel-plus is a web-based software platform designed for online reading and content management. It serves as a centralized system where administrators manage digital literature and users interact with that content through a web interface. Because it handles content storage and retrieval, the application relies on a backend database to store text, user information, and site settings.

What does CWE-89 mean for CVE-2023-37847?

CWE-89 identifies this flaw as a SQL injection vulnerability. In plain terms, this means the software does not properly sanitize input, allowing an attacker to insert their own malicious database commands into the application. Instead of just reading or processing data as intended, the application executes the attacker's commands, potentially granting them unauthorized control over the database.

How is this vulnerability triggered?

An attacker triggers this bug by sending specially crafted network requests to the application that contain malicious SQL code. Because the application fails to distinguish between legitimate user data and executable commands, the query is processed directly by the database. Simply browsing the site normally or using the software's intended features does not trigger the vulnerability; it requires a request specifically designed to inject unauthorized commands.

Is my instance of novel-plus at risk?

According to Halo Surface Signal, novel-plus is typically deployed as a public-facing web service accessible via the internet. This design means that any instance reachable from the public web is inherently more exposed to network-based interaction. If your instance is hosted on the public internet, it should be considered a potential target for this vulnerability, whereas internal-only instances may have a reduced direct attack surface.

What should I do if I run novel-plus?

The first step is to confirm where novel-plus is deployed in your environment and identify which team is responsible for its maintenance. Once located, assess its accessibility and business importance to prioritize your response. You should coordinate with the platform team to determine if an update is available or if temporary network-level mitigations are needed to restrict access until the vulnerability is addressed.

References

novel.xxyopen.com/index.htm

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.