---
id: "CVE-2026-111685"
kind: "vulnerability"
aliases: ["CVE-2026-111685"]
title: "IceCMS: unauthenticated SQL injection reads database via resource lookup"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "IceCMS", "fixed": [], "affected": "<= 4.1.5", "ecosystem": "github"}]
ecosystems: []
tags: ["icecms", "java", "other", "self-hosted", "spring-boot", "sql-injection", "unauthenticated"]
not_affected_if: ["default-config", "endpoint-blocked-at-gateway", "patched-locally"]
published_at: "2026-10-16T18:17:51+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-24T00:24:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111685", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:24:27+00:00"}]
---

# IceCMS: unauthenticated SQL injection reads database via resource lookup

IceCMS through 4.1.5 (no release tags; default-branch commit afd7a9f) concatenates the num path variable into QueryWrapper.last("limit " + num) in /WebResource/findresourcebynum/{content}/{num}. The /WebResource prefix is not in the Shiro JWT filter chain, so anonymous callers reach it. Union or blind SQLi reads the database. Stacked queries are not enabled by default, and no RCE is claimed. No patch is published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:IceCMS affected <= 4.1.5 fixed ?

## How to check

Self-hosted: request GET /WebResource/findresourcebynum/a/1%20and%20sleep(3) and see if the response is delayed ~3s (or a union probe changes output). Or inspect WebResourceController.java: if num is a String used in .last("limit " + num), you are vulnerable. Check your reverse proxy or WAF logs for requests to /WebResource/ and /WebArticle/ with SQL keywords.

## Fix

No patched version published. Workaround: change num from String to Integer in WebResourceController (lines 128-134) and WebArticleController (169-175), and use last("limit {0}", num). Or block /WebResource/findresourcebynum and /WebArticle/findarticlesbynum at the gateway or WAF. Rotate credentials stored in the DB if exposure is suspected.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111685
- 2026-10-24T00:24:27+00:00 analyst — VulnCheck advisory plus researcher hackmd write-up (static review, no runtime PoC, no exploitation seen). No fixed release exists: project has no release tags, affected is HEAD commit afd7a9f (4.1.5). Sibling CVE-2026-111686 is the same bug in /WebArticle/findarticlesbynum. Did not search social posts.

## Documents

- [advisory] VulnCheck: IceCMS through 4.1.5 SQLi via /WebResource/findresourcebynum https://www.vulncheck.com/advisories/icecms-through-4.1.5-sql-injection-via-webresource-findresourcebynum
- [describes] IceCMS unauthenticated SQL injection in WebResource and WebArticle preview-by-num endpoints (static review, no PoC run) https://hackmd.io/@hieuPenguinnn/icecms-webresource-webarticle-findbynum-limit-sqli

## From the sources

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_