CVE-2026-111686
Received Received - Intake

SQL Injection in IceCMS

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111686
EUVD
EUVD-2026-102977

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Thecosy IceCMS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IceCMS versions up to 4.1.5 have an unauthenticated SQL injection flaw in the /WebArticle/findarticlesbynum endpoint. The 'num' path parameter is not properly sanitized, allowing attackers to inject malicious SQL code after the LIMIT clause. This can be exploited via union-based or blind SQL injection to extract sensitive database information.

Detection Guidance

To detect this vulnerability, check if your IceCMS instance is running versions up to 4.1.5. Test the /WebArticle/findarticlesbynum endpoint by sending requests with malicious SQL payloads in the 'num' parameter. Use tools like curl or Burp Suite to send crafted requests such as: curl http://target.com/WebArticle/findarticlesbynum/1/1%27%20OR%201=1--. If the server responds with database errors or unexpected data, the vulnerability may be present.

Additionally, inspect network traffic for suspicious SQL query patterns or errors in responses from the /WebArticle/findarticlesbynum endpoint.

Impact Analysis

This vulnerability allows remote attackers to read sensitive data from the IceCMS database without authentication. Attackers could extract user credentials, personal information, or other confidential data stored in the system. The high CVSS score indicates significant risk to confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable IceCMS versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately upgrade IceCMS to a version that fixes this vulnerability. If an update is unavailable, restrict access to the /WebArticle/findarticlesbynum and /WebResource/findresourcebynum endpoints by modifying server configurations or firewall rules. Implement input validation to ensure the 'num' parameter is strictly numeric.

Replace direct SQL string concatenation with parameterized queries or bound placeholders in the code. Add server-side validation to reject non-numeric input and enforce strict type checking for the 'num' parameter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111686. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart