CVE-2025-3856: Xxyopen Novel-Plus SQLi Vulnerability

CVE-2025-3856 Overview

A critical SQL Injection vulnerability has been discovered in xxyopen Novel-Plus version 5.1.0. The vulnerability exists in the searchByPage function located at the /book/searchByPage endpoint. Attackers can exploit this flaw by manipulating the sort parameter to inject malicious SQL queries, potentially compromising the entire database. The attack can be initiated remotely without requiring significant technical complexity.

Critical Impact

This SQL Injection vulnerability allows remote attackers to manipulate database queries through the sort parameter, potentially leading to unauthorized data access, data modification, or complete database compromise.

Affected Products

• xxyopen Novel-Plus version 5.1.0
• Novel-Plus book search functionality (/book/searchByPage endpoint)
• Applications utilizing the vulnerable searchByPage function

Discovery Timeline

• 2025-04-22 - CVE-2025-3856 published to NVD
• 2025-10-15 - Last updated in NVD database

Technical Details for CVE-2025-3856

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) stems from inadequate input validation in the searchByPage function of Novel-Plus. The application fails to properly sanitize user-supplied input in the sort parameter before incorporating it into SQL queries. This allows attackers to break out of the intended query structure and inject arbitrary SQL commands.

The vulnerability falls under the broader category of Injection flaws (CWE-74), where untrusted data is sent to an interpreter as part of a command or query. In this case, the SQL interpreter processes attacker-controlled input without proper sanitization, enabling unauthorized database operations.

Root Cause

The root cause of this vulnerability is improper input validation and the lack of parameterized queries in the searchByPage function. The application directly concatenates user input from the sort parameter into SQL statements without sanitization or prepared statement usage. This classic SQL Injection pattern allows attackers to modify the query's logic and access or manipulate data beyond their authorization level.

Attack Vector

The vulnerability is exploitable over the network, requiring no physical access to the target system. An authenticated attacker with low privileges can remotely send crafted HTTP requests to the /book/searchByPage endpoint with malicious payloads in the sort parameter. The attack does not require user interaction and can be automated for large-scale exploitation.

The exploit has been publicly disclosed, and proof-of-concept details are available. While the vendor was contacted regarding this vulnerability, no response was received. Technical details can be found in the GitHub PoC Repository and documented in the VulDB entry #305781.

Detection Methods for CVE-2025-3856

Indicators of Compromise

• Unusual SQL error messages in application logs originating from /book/searchByPage requests
• HTTP requests to /book/searchByPage containing SQL syntax characters in the sort parameter (e.g., ', --, UNION, SELECT)
• Database query logs showing unexpected or malformed queries from the book search functionality
• Abnormal data access patterns or unauthorized data retrieval from the Novel-Plus database

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL Injection patterns in the sort parameter of requests to /book/searchByPage
• Configure application logging to capture all requests to the vulnerable endpoint with full parameter details
• Deploy database activity monitoring to alert on suspicious query patterns such as UNION SELECT, comment sequences, or time-based blind injection attempts
• Enable intrusion detection signatures for SQL Injection attacks targeting Java/Spring-based web applications

Monitoring Recommendations

• Monitor access logs for repeated requests to /book/searchByPage with varying sort parameter values
• Set up alerts for database errors or exceptions originating from the book search functionality
• Track for unusual database response times that may indicate time-based blind SQL Injection attempts
• Review authentication logs for privilege escalation attempts following potential SQL Injection exploitation

How to Mitigate CVE-2025-3856

Immediate Actions Required

• Restrict or disable access to the /book/searchByPage endpoint until a patch is applied
• Implement input validation to whitelist acceptable values for the sort parameter
• Deploy Web Application Firewall rules to block SQL Injection attempts targeting the vulnerable endpoint
• Review database permissions and apply principle of least privilege to the application's database account

Patch Information

No official patch has been released by the vendor. The vendor (xxyopen) was contacted about this vulnerability but did not respond. Organizations using Novel-Plus 5.1.0 should implement the workarounds described below and monitor for any future vendor security updates. For additional context, refer to the VulDB submission #557011.

Workarounds

• Implement a WAF rule or reverse proxy filter to sanitize or block the sort parameter in requests to /book/searchByPage
• Modify application code to use parameterized queries or prepared statements for the searchByPage function if source code access is available
• Restrict network access to the vulnerable endpoint to trusted IP addresses only
• Consider disabling the book search functionality entirely if it is not critical to operations

# Example WAF rule to block SQL injection in sort parameter (ModSecurity)
SecRule ARGS:sort "@detectSQLi" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt detected in sort parameter - CVE-2025-3856',\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'attack-sqli'"