Description
novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP or purchase verification, bypassing the permission checks and data-scope limits enforced elsewhere in the admin interface.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| 201206030 | novel-plus | ≤ 5.3.3 | — |
References
- GET /novel/book/download missing authorization proof of concept exploit
- BookController.download is the only one of nine methods without @RequiresPermissions technical-description
- The reader portal gates paid chapters behind a needBuy purchase check that the admin download endpoint omits technical-description
- novel-plus v5.3.3 Release Notes release-notes
- Product product
- VulnCheck Advisory: novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint third-party-advisory