Icecms Through 4.1.5 Sql Injection Via Webresource Findresourcebynum

Back www.vulncheck.com

Icecms Through 4.1.5 Sql Injection Via Webresource Findresourcebynum

www.vulncheck.com • October 17, 2026

Share: View original

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Unauthenticated SQL Injection Vulnerability in IceCMS 4.1.5 IceCMS version 4.1.5 has been found to contain an unauthenticated SQL injection vulnerability affecting the WebResource and WebArticle preview endpoints. The endpoints, /WebResource/findresourcebynum/{content}/{num} and /WebArticle/findarticlesbynum/{content}/{num}, allow attackers to manipulate SQL queries by injecting arbitrary values into the 'num' parameter. This vulnerability is classified as CWE-89, which pertains to improper neutralization of special elements used in SQL commands. The issue arises from the lack of authentication checks due to the absence of certain controller prefixes in the Apache Shiro JWT filter chain. As a result, an anonymous attacker can exploit this flaw to read data from the IceCMS database. No patches or fixes have been reported as of the publication date. The vulnerability is currently and poses a significant risk to users of the affected version. 52

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

CWE-89 - SQL Injection