CVE-2025-3369 is a Medium (CVSS 6.3) SQL injection in xxyopen Novel-Plus 5.1.0. The sort argument of the /novel/friendLink/list endpoint reaches a query unsafely. No fixed version is named in the record, so check the project's releases and restrict access to the admin area.
Note that the title of this post says Medium. The record's own wording calls the issue critical, but the CVSS score of 6.3 puts it in the Medium band, and this post follows the score.
What's affected
The record lists one product and version: xxyopen Novel-Plus 5.1.0, a Java web application for running a novel publishing site. The endpoint named is /novel/friendLink/list, and the argument is sort. The vector shows low privileges required, so the caller needs an account of some kind.
The description says the attack can be launched remotely and that an exploit has been disclosed to the public. The record's KEV flag is false, so the CVE is not on the CISA Known Exploited Vulnerabilities list.
The record does not name a fixed release. The reference list points to a write up by the reporter on GitHub and a VulDB entry. I could not load the reporter's page when reviewing, so confirm details against the project repository before relying on this post.
How to check if you're exposed
- Find out which version of Novel-Plus you run. Check the application's about page, its build file or the release tag you deployed. Only 5.1.0 is named in the record.
- Look in the source for the friend link listing code and see how the
sortvalue is placed into the query. If the value is concatenated into an SQL fragment, the flaw is present in your build. - Check whether the endpoint is reachable from the internet, and what role a caller needs.
- Review web server and application logs for unusual
sortvalues on that path. - Run the free in-browser dependency scan on your pom.xml or build files to see what else is outdated. It checks libraries, not the application's own query code.
What to do now
- Check the Novel-Plus repository for a release newer than 5.1.0 that addresses the issue, and read its notes before upgrading.
- If you cannot upgrade, change the code that builds the ordering clause so the
sortvalue is matched against a fixed list of allowed column names. Sorting columns cannot be bound as ordinary query parameters, so an allowlist is the usual fix. - Restrict the endpoint to trusted users and networks until you have applied a fix.
- Review accounts with access to the admin area, and remove any that are not needed.
- Back up the database before making changes.
Why it matters
The weakness is CWE-89, improper neutralization of special elements in an SQL command, under the parent class CWE-74. The sort parameter is a good reminder that injection is not limited to values in a WHERE clause. Developers often pass sort order, column names and direction straight from a request, and those parts of a query cannot be protected by ordinary parameter binding.
The score is lower than similar records because an account is required and the impact is rated low on all three axes. That does not make it safe to ignore on a public site where sign up is open.
Quick check
Why does sorting cause SQL injection?
Query parameters can safely carry values but not column names or sort directions. If code pastes a request supplied sort value into the query text, the input becomes part of the command. Match it against an allowlist instead.
Sources
- Gold vulnerability page for CVE-2025-3369
- The reference list in the NVD record, which points to a reporter write up and a VulDB entry. I could not retrieve those pages, so no fixed version is confirmed.
Last reviewed: 18 October 2026.
