IceCMS CVE-2026-111686

No special conditions - remote unauthenticated exploitation against default configurations of Thecosy IceCMS, since the vulnerable /WebArticle/findarticlesbynum endpoint is reachable without authentication (PR:N) and requires no user interaction (UI:N). The only concrete prerequisite is that the attacker can send HTTP requests to the application and that the targeted instance runs IceCMS at or below version 4.1.5. The specific trigger is the num path parameter, whose value is concatenated after the LIMIT clause into a MyBatis-Plus QueryWrapper. Limiting factors are minimal: exploitation is confined to database reads (confidentiality impact only, VI:N/VA:N), and instances patched beyond 4.1.5 or not publicly exposed are not reachable.

Multiple signals converge on this being a genuine, high-priority exposure for anyone running IceCMS. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H) describes remote, network-reachable, low-complexity, unauthenticated exploitation with no user interaction - the hardest-to-mitigate profile - and the description corroborates it exactly ('unauthenticated sql injection' reachable over HTTP). Base score 8.7 is consistent with high confidentiality impact only (VC:H; VI/VA:N), matching a read-oriented union-based/blind extraction rather than data tampering. The CVSS network/unauthenticated claim and the description do NOT conflict - they agree. Tempering the raw severity: no EPSS score was supplied, so statistical exploitation probability cannot be stated, and the CVE is NOT in CISA KEV, so there is no evidence of active in-the-wild exploitation. However, a detailed public technical writeup (hackmd) plus a direct link to the vulnerable source lines effectively lowers the barrier to weaponization. Net: treat as a real priority for IceCMS operators because it is unauthenticated and trivially triggerable, while recognizing the limited real-world blast radius comes from the product's small deployment footprint, not from any weakness in the vulnerability itself.

A remote attacker with no credentials sends a single crafted HTTP request to the /WebArticle/findarticlesbynum endpoint, placing malicious SQL in the num path parameter so it is appended after the LIMIT clause concatenated into the MyBatis-Plus QueryWrapper. Using union-based or blind techniques, the attacker reads arbitrary database contents such as user records and password hashes. A public technical writeup on hackmd documents the injection point and method, so no custom research is needed to reproduce it.