CVE-2026-111685
CVE-2026-111685 · IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.
CVSS 8.7 · Alta · EPSS 0,5%
- Publicación
- Actualización
Productos y versiones afectados
icecms
- Versiones
- ≥ 0, ≤ 4.1.5: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@hieuPenguinnn/icecms-webresource-webarticle-findbynum-limit-sqli
- https://github.com/Thecosy/IceCMS/blob/afd7a9f0d04a714e7c7e735e566c27f54b5d5201/IceCMS-ment/src/main/java/com/ttice/icewkment/controller/frontend/WebResourceController.java#L128-L134
- https://github.com/Thecosy/IceCMS
- https://www.vulncheck.com/advisories/icecms-through-4.1.5-sql-injection-via-webresource-findresourcebynum
- https://nvd.nist.gov/vuln/detail/CVE-2026-111685