CVE-2024-24018

Summary

CVE-2024-24018 is a newly disclosed SQL injection vulnerability that affects Novel-Plus versions 4.3.0-RC1 and earlier. Malicious actors can exploit this flaw by passing maliciously crafted offset, limit, and sort parameters to the /system/dataPerm/list endpoint. Successful exploitation could lead to unauthorized access to sensitive data, privilege escalation, or even a complete system takeover. Users are urged to upgrade to a patched version of Novel-Plus as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.