IceCMS: Unauthenticated SQL injection in /WebArticle/findarticlesbynum
Summary
IceCMS through version 4.1.5 contains an SQL injection flaw in the num path parameter of /WebArticle/findarticlesbynum. The input is concatenated after the LIMIT clause into a MyBatis-Plus QueryWrapper without sanitization. A remote, unauthenticated attacker can append crafted SQL to read database contents using union-based or blind techniques. Any internet-facing IceCMS instance is exposed.
Affected
- IceCMS 0 to 4.1.5 (per CNA data)
- Affected endpoint: /WebArticle/findarticlesbynum, parameter num
Fixed in
Unknown. No vendor advisory or patch has been confirmed. A third-party page mentions version 4.1.6, but this is not verified by the vendor.
Workaround
- No vendor-issued workaround known.
- Restrict or block access to /WebArticle/* at the reverse proxy or WAF if the endpoint is not needed publicly. A WAF rule is a stopgap and can be bypassed.
- Run the database account used by IceCMS with minimal privileges.
Exploitation
- No confirmed exploitation in the wild found. CISA SSVC lists exploitation as none, and the KEV status is No.
- Public write-ups are referenced in the CVE record, so a public technique should be assumed.
Our recommendation
- Check whether IceCMS is in use and whether it is reachable from the internet.
- Restrict access to the affected endpoint now and limit database privileges.
- Review web server logs for requests to /WebArticle/findarticlesbynum with unusual num values.
- Upgrade once the vendor confirms a fixed version. If no fix is available, take the instance offline or limit it to the internal network.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Thecosy IceCMS repository github.com
- Vulnerable code in WebArticleController.java github.com
- VulnCheck advisory www.vulncheck.com
- HackMD write-up hackmd.io
- VulDB CVE-2026-111686 vuldb.com
- Vulners (Mend) CVE-2026-111686 vulners.com
- Strix.ai CVE-2026-111686 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:14.
Original description (NVD)
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.
NVD references (4)
- https://github.com/Thecosy/IceCMS
- https://github.com/Thecosy/IceCMS/blob/afd7a9f0d04a714e7c7e735e566c27f54b5d5201/IceCMS-ment/src/main/java/com…
- https://hackmd.io/@hieuPenguinnn/icecms-webresource-webarticle-findbynum-limit-sqli
- https://www.vulncheck.com/advisories/icecms-through-4.1.5-sql-injection-via-webarticle-findarticlesbynum
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.