CVE-2025-1154: xxyopen Novel SQL Injection Vulnerability

CVE-2025-1154 Overview

CVE-2025-1154 is a SQL injection vulnerability in xxyopen Novel versions up to 3.4.1. The flaw resides in the /api/front/search/books endpoint, where the sort parameter is passed to the database layer without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. Exploitation requires network access and low-privileged authentication. Additional parameters in the same endpoint may also be affected. The exploit has been publicly disclosed, increasing the likelihood of opportunistic scanning and abuse. The vulnerability is tracked under CWE-74 (Improper Neutralization of Special Elements in Output).

Critical Impact
Authenticated remote attackers can inject SQL statements through the sort parameter, potentially exposing or modifying data stored in the Novel application database.

Affected Products

xxyopen Novel versions up to and including 3.4.1
The /api/front/search/books API endpoint
Deployments exposing the Novel front-end search API to untrusted networks

Discovery Timeline

2025-02-10 - CVE-2025-1154 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1154

Vulnerability Analysis

The vulnerability affects the book search functionality exposed at /api/front/search/books in xxyopen Novel. The sort request parameter is concatenated into a backend SQL query without adequate validation or parameterization. An authenticated attacker can craft a request that alters query semantics, enabling data exfiltration, unauthorized reads, or modification of records. The public disclosure of exploit details lowers the barrier for reproduction. Because search endpoints are typically indexed by front-end clients, the attack surface is easily reachable in production deployments.

Root Cause

The root cause is improper neutralization of user-supplied input passed to a downstream SQL interpreter, categorized as CWE-74. The sort argument is used to construct an ORDER BY clause or similar SQL fragment, which cannot be bound as a prepared-statement parameter. Without an allowlist of permitted column names or sort directions, arbitrary SQL syntax reaches the database engine. The advisory notes that additional parameters in the same handler may exhibit the same defect.

Attack Vector

Exploitation occurs remotely over the network by sending a crafted HTTP request to the Novel search API. The attacker requires low-privileged credentials to reach the authenticated endpoint. No user interaction is needed. The manipulation targets the sort query parameter with SQL syntax that extends the intended query. See the public gist proof of concept and the VulDB entry #295058 for reproduction details.

No verified exploit code is included here. Refer to the linked references for technical proof-of-concept details.

Detection Methods for CVE-2025-1154

Indicators of Compromise

HTTP requests to /api/front/search/books containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or comment sequences (--, /*) inside the sort parameter
Unusual database query latency correlated with search API traffic, indicating time-based blind injection attempts
Application logs showing SQL syntax errors originating from the search handler
Repeated authenticated requests from a single source cycling through payload variations against the sort parameter

Detection Strategies

Deploy web application firewall rules that inspect the sort parameter for SQL metacharacters and known injection patterns
Enable database query logging and alert on ORDER BY clauses containing subqueries, UNION operators, or conditional expressions
Correlate authentication events with search API abuse to identify compromised low-privileged accounts

Monitoring Recommendations

Forward Novel application and reverse-proxy logs to a centralized analytics platform for query pattern analysis
Baseline normal sort parameter values and alert on deviations from the expected allowlist (for example, id, time, score)
Monitor outbound database connections and record counts for anomalous bulk reads following search API activity

How to Mitigate CVE-2025-1154

Immediate Actions Required

Inventory all xxyopen Novel deployments and identify instances running version 3.4.1 or earlier
Restrict access to the /api/front/search/books endpoint to trusted networks until a patched build is deployed
Rotate credentials for any accounts that may have interacted with a vulnerable instance exposed to untrusted users
Review database audit logs for evidence of injection attempts against the search endpoint

Patch Information

At the time of publication, no vendor advisory or fixed release was linked in the enriched CVE data. Consult the upstream xxyopen Novel repository for the latest releases and monitor the VulDB entry #295058 for updates on remediation guidance.

Workarounds

Enforce an allowlist of permitted sort values at a reverse proxy or API gateway, rejecting requests containing SQL metacharacters
Apply least-privilege database roles so the Novel service account cannot read unrelated tables or execute administrative statements
Disable or gate the front-end search API behind authentication with additional rate limiting to reduce exploitation opportunities

bash

# Example NGINX rule rejecting non-allowlisted sort values
location /api/front/search/books {
    if ($arg_sort !~* '^(id|time|score|visit_count)$') {
        return 400;
    }
    proxy_pass http://novel_backend;
}