{"id":"CVE-2026-111686","kind":"vulnerability","aliases":["CVE-2026-111686"],"related":[],"title":"IceCMS: unauthenticated SQL injection in article lookup exposes database","description":"IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.","summary":"IceCMS through 4.1.5 (Spring Boot, Apache Shiro, MyBatis-Plus) concatenates the String path variable num into QueryWrapper.last(\"limit \" + num) in GET /WebArticle/findarticlesbynum/{content}/{num}. /WebArticle is not in the Shiro jwt filter chain, so any anonymous caller can append SQL after LIMIT and read the database with union or blind injection. Stacked queries are not available by default (allowMultiQueries not set). No public exploit and no known exploitation. No upstream fix is known.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IceCMS","fixed":[],"affected":"<= 4.1.5 (commit afd7a9f)","ecosystem":"github"}],"ecosystems":[],"tags":["icecms","java","mybatis-plus","other","self-hosted","sql-injection","unauthenticated"],"not_affected_if":["auth-required","default-config","managed-hosting"],"how_to_check":"Exposed if you run IceCMS (any build up to 4.1.5, commit afd7a9f or earlier) and the backend is reachable. Check WebArticleController.java for .last(\"limit \" + num) with num typed String. Safe test on your own instance: GET /WebArticle/findarticlesbynum/a/1%20and%20sleep(3) and see whether the response is delayed. Also check /WebResource/findresourcebynum (CVE-2026-111685). Look for these paths in access logs.","fix":"No fixed release known (the project has no release tags). Patch the source: make num an Integer and bind it with .last(\"limit {0}\", num), in both WebArticleController and WebResourceController. Until then, block or restrict /WebArticle/findarticlesbynum and /WebResource/findresourcebynum at the reverse proxy or WAF, and run the DB user with least privilege.","status":"open","published_at":"2026-10-16T18:17:51+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:39:04+00:00","updated_at":"2026-10-24T00:24:39+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:39:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IceCMS: unauthenticated SQL injection in article lookup exposes database","impact":"high","summary":"IceCMS through 4.1.5 lets remote attackers inject SQL through the num path parameter of /WebArticle/findarticlesbynum. An attacker can read database contents using union-based or blind techniques, without logging in.","category":"other","who_cares":["icecms","java","mybatis-plus"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads all database contents, including user credentials, without logging in","analyst_note":"Check NVD and the IceCMS project for a fixed version after 4.1.5 and whether the findarticlesbynum endpoint is exposed in default installs.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000463,"input_tokens":2945,"output_tokens":336,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check NVD and the IceCMS project for a fixed version after 4.1.5 and whether the findarticlesbynum endpoint is exposed in default installs.","search":"'-111686':12A,15A '-2026':11A,14A '/webarticle':55B '/webarticle/findarticlesbynum':52B,126C '4.1.5':32B,106C 'allow':114C 'allowmultiqueri':89B 'anonym':66B 'apach':35B 'append':69B,129C 'articl':6A 'attack':116C,127C 'avail':86B 'base':150C 'blind':80B,152C 'boot':34B 'caller':67B 'chain':63B 'claus':135C 'concaten':40B,136C 'contain':107C 'content':53B,146C 'craft':130C 'cve':10A,13A 'databas':9A,76B,145C 'default':88B 'exploit':94B,98B 'expos':8A 'extract':144C 'filter':62B 'fix':101B 'get':51B 'host':25B 'icecm':1A,17B,30B,104C 'icecms':16A 'inject':4A,28B,81B,111C,118C 'java':18B 'jwt':61B 'known':97B,103B 'limit':48B,72B,134C 'lookup':7A 'mybati':20B,38B,140C 'mybatis-plus':19B,37B,139C 'num':45B,49B,54B,122C 'paramet':124C 'path':43B,123C 'plus':21B,39B,141C 'public':93B 'queri':83B 'querywrapp':142C 'querywrapper.last':47B 'read':74B 'remot':115C 'self':24B 'self-host':23B 'set':91B 'shiro':36B,60B 'spring':33B 'sql':3A,27B,70B,110C,119C,131C 'sql-inject':26B 'stack':82B 'string':42B 'techniqu':153C 'unauthent':2A,29B,109C 'union':78B,149C 'union-bas':148C 'upstream':100B 'variabl':44B 'via':147C 'vulner':112C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111686","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111686","severity":null,"published_at":"2026-10-16T18:17:51+00:00","modified_at":"2026-10-16T22:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111686:655","url":null,"severity":null,"published_at":"2026-10-24T00:24:36+00:00","modified_at":"2026-10-24T00:24:39+00:00","first_seen_at":"2026-10-24T00:24:36+00:00","fetched_at":"2026-10-24T00:24:39+00:00","note":"Correction: removed wrong auth-required tag; flaw is unauthenticated. Sources: VulnCheck advisory, hackmd writeup."}],"documents":[{"id":2587,"url":"https://www.vulncheck.com/advisories/icecms-through-4.1.5-sql-injection-via-webarticle-findarticlesbynum","title":"VulnCheck: IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2586,"url":"https://hackmd.io/@hieuPenguinnn/icecms-webresource-webarticle-findbynum-limit-sqli","title":"IceCMS unauthenticated SQL injection in WebResource and WebArticle preview-by-num endpoints (static review, no PoC run)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2589,"url":"https://github.com/Thecosy/IceCMS/blob/afd7a9f0d04a714e7c7e735e566c27f54b5d5201/IceCMS-ment/src/main/java/com/ttice/icewkment/controller/frontend/WebArticleController.java","title":"WebArticleController.java at afd7a9f (vulnerable sink L169-175)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}