CVE-2026-111686 Details

A SQL injection vulnerability has been identified in IceCMS versions through 4.1.5. The issue resides in the WebArticleController, specifically within the findarticlesbynum endpoint. This vulnerability allows remote attackers to inject SQL through the num path parameter. The injected SQL can be appended after the LIMIT clause, using a MyBatis-Plus QueryWrapper, to extract data from the database using union-based or blind SQL injection techniques. The vulnerability is exploitable without authentication, as the WebArticle and WebResource prefixes are not included in the Shiro JWT filter chain, leaving these endpoints open to anonymous access.

The vulnerability can be addressed by modifying the WebArticleController to change the 'num' parameter from a String to an Integer, preventing non-numeric input from being processed. Additionally, user input should not be concatenated directly into SQL queries. Instead, use parameterized queries or MyBatis-Plus's built-in pagination features to safely handle limit values. After applying these changes, the SQL injection vulnerability can be closed.