{"id":7203,"date":"2025-06-23T22:08:21","date_gmt":"2025-06-23T22:08:21","guid":{"rendered":"http:\/\/localhost\/?p=7203"},"modified":"2025-06-23T22:08:21","modified_gmt":"2025-06-23T22:08:21","slug":"xxyopen201206030-novel-plus-user-management-module-usermapperxml-list-sql-injection","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=7203","title":{"rendered":"xxyopen\/201206030 novel-plus User Management Module UserMapper.xml list sql injection"},"content":{"rendered":"
\n

CVE Details<\/h2>\n
\n
\n

Basic Information<\/h3>\n\n\n\n\n\n
Title<\/th>\nxxyopen\/201206030 novel-plus User Management Module UserMapper.xml list sql injection<\/td>\n<\/tr>\n
Type<\/th>\ncve<\/td>\n<\/tr>\n
Published<\/th>\n2025-06-24T01:00:20.961Z<\/td>\n<\/tr>\n
Last Seen<\/th>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n
\n

Product Information<\/h3>\n\n\n\n\n
Vendor<\/th>\nxxyopen<\/td>\n<\/tr>\n
Product<\/th>\nnovel-plus<\/td>\n<\/tr>\n
Version<\/th>\n5.1.0<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n
\n

CVSS Information<\/h3>\n\n\n\n\n\n\n
Base Score<\/th>\n5.3 (MEDIUM)<\/td>\n<\/tr>\n
Attack Vector<\/th>\nCVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:L\/VI:L\/VA:L\/SC:N\/SI:N\/SA:N\/E:P<\/td>\n<\/tr>\n
Confidentiality Impact<\/th>\n<\/td>\n<\/tr>\n
Integrity Impact<\/th>\n<\/td>\n<\/tr>\n
Availability Impact<\/th>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n
\n

AI Analysis<\/h3>\n\n\n\n\n\n\n
AI Description<\/th>\nA SQL injection vulnerability in the User Management Module of novel-plus allows remote attackers to inject malicious SQL code via the ‘sort’ or ‘order’ parameters. This could lead to unauthorized data access or system compromise. The issue affects versions up to 5.1.3 and has a publicly disclosed exploit.<\/td>\n<\/tr>\n
AI Severity<\/th>\nMedium<\/td>\n<\/tr>\n
Vendor<\/th>\nxxyopen<\/td>\n<\/tr>\n
Product<\/th>\nnovel-plus<\/td>\n<\/tr>\n
Affected Version<\/th>\n5.1.0, 5.1.1, 5.1.2, 5.1.3<\/td>\n<\/tr>\n<\/table>\n<\/div>\n
\n

Affected Products<\/h4>\n