IceCMS CVE-2026-111685

No special conditions - remote unauthenticated exploitation against default configurations of IceCMS (through 4.1.5) wherever the /WebResource/findresourcebynum endpoint is network-reachable. The specific trigger is a crafted 'num' path parameter that is concatenated after the SQL LIMIT clause via MyBatis-Plus QueryWrapper.last() without parameterization. Limiting factors are minimal: no authentication, user interaction, or non-default setting is required; the main practical constraints are network reachability of the IceCMS instance and running an affected version (≤4.1.5). Impact is confined to database read/disclosure (confidentiality), not data modification or code execution.

Multiple signals align toward genuine priority for exposed instances. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, and the description corroborates this: a crafted 'num' path parameter is concatenated directly into a SQL LIMIT clause via QueryWrapper.last(). The CWE-89 classification and VulnCheck advisory reinforce that this is a classic injection. Impact is scoped to confidentiality (VC:H; VI/VA:N), consistent with data extraction via union-based or blind techniques rather than write/RCE - so raw severity (8.7) somewhat overstates operational impact, which is read-only database disclosure. A public technical write-up (hackmd) documents the exact exploitation path, lowering the barrier to attack. No CISA KEV listing is present and no EPSS score was supplied, so there is NO confirmed evidence of active in-the-wild exploitation; the primary risk driver is ease of exploitation plus public methodology, not observed attacks. The chief mitigating factor is real-world deployment footprint: IceCMS is a niche open-source CMS, so the aggregate internet-facing attack surface is likely small. Net assessment: high priority to patch for any organization actually running IceCMS, but limited broad-ecosystem risk.

A remote, unauthenticated attacker locates an internet-facing IceCMS (≤4.1.5) instance and sends a crafted request to /WebResource/findresourcebynum with a malicious 'num' path value. Because the value is appended after the SQL LIMIT clause without sanitization, the attacker uses union-based or blind SQL injection to enumerate and exfiltrate database contents such as user records and credentials. A public technical write-up detailing this exact technique exists, reducing the effort required.