{"id":"CVE-2026-111685","kind":"vulnerability","aliases":["CVE-2026-111685"],"related":[],"title":"IceCMS: unauthenticated SQL injection reads database via resource lookup","description":"IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.","summary":"IceCMS through 4.1.5 (no release tags; default-branch commit afd7a9f) concatenates the num path variable into QueryWrapper.last(\"limit \" + num) in /WebResource/findresourcebynum/{content}/{num}. The /WebResource prefix is not in the Shiro JWT filter chain, so anonymous callers reach it. Union or blind SQLi reads the database. Stacked queries are not enabled by default, and no RCE is claimed. No patch is published.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IceCMS","fixed":[],"affected":"<= 4.1.5","ecosystem":"github"}],"ecosystems":[],"tags":["icecms","java","other","self-hosted","spring-boot","sql-injection","unauthenticated"],"not_affected_if":["default-config","endpoint-blocked-at-gateway","patched-locally"],"how_to_check":"Self-hosted: request GET /WebResource/findresourcebynum/a/1%20and%20sleep(3) and see if the response is delayed ~3s (or a union probe changes output). Or inspect WebResourceController.java: if num is a String used in .last(\"limit \" + num), you are vulnerable. Check your reverse proxy or WAF logs for requests to /WebResource/ and /WebArticle/ with SQL keywords.","fix":"No patched version published. Workaround: change num from String to Integer in WebResourceController (lines 128-134) and WebArticleController (169-175), and use last(\"limit {0}\", num). Or block /WebResource/findresourcebynum and /WebArticle/findarticlesbynum at the gateway or WAF. Rotate credentials stored in the DB if exposure is suspected.","status":"open","published_at":"2026-10-16T18:17:51+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:39:03+00:00","updated_at":"2026-10-24T00:24:27+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:39:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IceCMS: unauthenticated SQL injection reads database via resource lookup","impact":"high","summary":"IceCMS through 4.1.5 lets remote attackers inject SQL through the num path parameter of /WebResource/findresourcebynum, with no login needed. An attacker can extract database contents using union-based or blind techniques.","category":"other","who_cares":["icecms","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"attacker reads database contents, possibly including credentials and user data","analyst_note":"Check the NVD entry for affected version range and any vendor patch or workaround; confirm whether the endpoint is reachable in default installs.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000455,"input_tokens":2939,"output_tokens":322,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry for affected version range and any vendor patch or workaround; confirm whether the endpoint is reachable in default installs.","search":"'-111685':12A,15A '-2026':11A,14A '/webresource':55B '/webresource/findresourcebynum':51B,117C '4.1.5':32B,95C 'afd7a9f':40B 'allow':103C 'anonym':66B 'append':120C 'attack':105C,118C 'base':136C 'blind':72B,138C 'boot':25B 'branch':38B 'caller':67B 'chain':64B 'claim':88B 'claus':125C 'commit':39B 'concaten':41B,126C 'contain':96C 'content':52B,132C 'craft':112C 'cve':10A,13A 'databas':6A,76B,131C 'default':37B,83B 'default-branch':36B 'enabl':81B 'extract':130C 'filter':63B 'host':22B 'icecm':1A,17B,30B,93C 'icecms':16A 'inject':4A,28B,100C,107C 'java':18B 'jwt':62B 'limit':48B,124C 'lookup':9A 'num':43B,49B,53B,113C 'paramet':115C 'patch':90B 'path':44B,114C 'prefix':56B 'publish':92B 'queri':78B 'querywrapper.last':47B,128C 'rce':86B 'reach':68B 'read':5A,74B 'releas':34B 'remot':104C 'resourc':8A 'self':21B 'self-host':20B 'shiro':61B 'spring':24B 'spring-boot':23B 'sql':3A,27B,99C,108C,121C 'sql-inject':26B 'sqli':73B 'stack':77B 'suppli':110C 'tag':35B 'techniqu':139C 'unauthent':2A,29B,98C 'union':70B,135C 'union-bas':134C 'use':133C 'variabl':45B 'via':7A,127C 'vulner':101C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111685","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111685","severity":null,"published_at":"2026-10-16T18:17:51+00:00","modified_at":"2026-10-19T14:16:59+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111685:656","url":null,"severity":null,"published_at":"2026-10-24T00:24:27+00:00","modified_at":"2026-10-24T00:24:27+00:00","first_seen_at":"2026-10-24T00:24:27+00:00","fetched_at":"2026-10-24T00:24:27+00:00","note":"VulnCheck advisory plus researcher hackmd write-up (static review, no runtime PoC, no exploitation seen). No fixed release exists: project has no release tags, affected is HEAD commit afd7a9f (4.1.5). Sibling CVE-2026-111686 is the same bug in /WebArticle/findarticlesbynum. Did not search social posts."}],"documents":[{"id":2585,"url":"https://www.vulncheck.com/advisories/icecms-through-4.1.5-sql-injection-via-webresource-findresourcebynum","title":"VulnCheck: IceCMS through 4.1.5 SQLi via /WebResource/findresourcebynum","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2586,"url":"https://hackmd.io/@hieuPenguinnn/icecms-webresource-webarticle-findbynum-limit-sqli","title":"IceCMS unauthenticated SQL injection in WebResource and WebArticle preview-by-num endpoints (static review, no PoC run)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}