Vulnerability · Published Dec 29, 2023 · Assigned by VulDB

CVE-2023-7166Novel-Plus HTTP POST Request updateUserInfo cross site scripting

Low 3.5

In plain English

A low-severity cross-site scripting in Novel-Plus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.5%top 54.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the argument nickName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c62da9bb3a9b3603014d0edb436146512631100d. It is recommended to apply a patch to fix this issue. The identifier VDB-249201 was assigned to this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
n/a	Novel-Plus	4.04.14.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

References

https://vuldb.com/?id.249201 vdb-entry, technical-description
https://vuldb.com/?ctiid.249201 signature, permissions-required
https://github.com/JTZ-a/SRC/blob/master/novel-plus/storedXSS/en-us.md exploit
https://github.com/201206030/novel-plus/commit/c62da9bb3a9b3603014d0edb436146512631100d patch