CVE-2026-111686 in IceCMS
Summary
by MITRE • 10/16/2026
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The IceCMS software, specifically versions up to and including 4.1.5, contains a critical unauthenticated SQL injection vulnerability located within the /WebArticle/findarticlesbynum endpoint. This flaw stems from improper input validation and sanitization of the num path parameter before it is processed by the underlying MyBatis-Plus framework. The application constructs database queries using a QueryWrapper object, which is designed to safely build dynamic SQL statements. However, in this specific implementation, user-supplied data for the num parameter is directly concatenated into the query structure without adequate encoding or type checking. This allows an attacker to inject arbitrary SQL commands that are executed by the backend database engine with the privileges of the application's database account.
The technical nature of this vulnerability involves the manipulation of the LIMIT clause within the generated SQL statement. By appending crafted SQL payloads after the expected numeric value, attackers can alter the logic of the query. This typically enables union-based injection techniques, where additional SELECT statements are appended to extract data from other tables in the database schema. Alternatively, blind SQL injection methods may be employed if direct output is not visible, allowing for time-based or boolean-based extraction of sensitive information such as administrative credentials, user emails, and proprietary content stored within the CMS database. The lack of authentication required to exploit this flaw significantly lowers the barrier to entry for malicious actors, making it a high-risk vulnerability that can be exploited by unauthenticated remote attackers over the network.
The operational impact of this SQL injection is severe, potentially leading to full system compromise depending on the configuration and privileges of the database user. Attackers can exfiltrate sensitive data, modify or delete records, and in some cases, execute operating system commands if the database engine allows for such extensions like xp_cmdshell in Microsoft SQL Server or similar features in MySQL. This compromises the confidentiality, integrity, and availability of the web application and its underlying data assets. The vulnerability aligns with CWE-89, which covers Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. From a tactical perspective, this exploitation technique maps to MITRE ATT&CK techniques such as T1059, Command and Scripting Interpreter, if command execution is achieved, or more directly to data exfiltration methods associated with database access.
To mitigate this vulnerability, immediate patching of IceCMS to version 4.1.6 or later is recommended, where the issue has been addressed by implementing proper parameterized queries or prepared statements that separate SQL logic from user input. If upgrading is not immediately feasible, administrators should implement a Web Application Firewall rule set designed to detect and block SQL injection patterns in URL parameters, particularly targeting the num field of the /WebArticle/findarticlesbynum endpoint. Additionally, enforcing strict type checking on server-side inputs can prevent non-numeric values from being processed as part of database queries. Regular security audits and static code analysis focused on ORM framework usage are essential to identify similar flaws where dynamic query construction might inadvertently expose injection points.