Summary
IceCMS through version 4.1.5 contains an unauthenticated SQL injection vulnerability in the resource lookup endpoint. A remote attacker may supply a crafted num path parameter to influence a database query and retrieve database contents through union-based or blind SQL injection techniques.
IceCMS through version 4.1.5 contains an unauthenticated SQL injection vulnerability in the resource lookup endpoint. A remote attacker may supply a crafted num path parameter to influence a database query and retrieve database contents through union-based or blind SQL injection techniques.
Affected context
The issue occurs in IceCMS deployments exposing /WebResource/findresourcebynum without authentication. It becomes risky when the num path parameter is incorporated into a query through QueryWrapper.last() without reliable parameterization or strict input validation, allowing request data to alter SQL execution.
The issue occurs in IceCMS deployments exposing /WebResource/findresourcebynum without authentication. It becomes risky when the num path parameter is incorporated into a query through QueryWrapper.last() without reliable parameterization or strict input validation, allowing request data to alter SQL execution.
Exploit preconditions
- Attack surface: Publicly reachable IceCMS resource lookup endpoint
- Required access: No authentication may be required
- Trigger point: Processing of the
numpath parameter - Why exploitation is possible: The parameter is concatenated into a query fragment associated with a
LIMITclause, allowing attacker-controlled input to affect database interpretation
- Attack surface: Publicly reachable IceCMS resource lookup endpoint
- Required access: No authentication may be required
- Trigger point: Processing of the
numpath parameter - Why exploitation is possible: The parameter is concatenated into a query fragment associated with a
LIMITclause, allowing attacker-controlled input to affect database interpretation
Why this happens
The vulnerability results from constructing SQL query fragments with externally supplied data instead of treating that data strictly as a value. Use of a query-builder escape hatch such as QueryWrapper.last() can bypass normal parameterization when input is concatenated into the resulting SQL. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection.
The vulnerability results from constructing SQL query fragments with externally supplied data instead of treating that data strictly as a value. Use of a query-builder escape hatch such as QueryWrapper.last() can bypass normal parameterization when input is concatenated into the resulting SQL. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection.
Potential impact
- An attacker may retrieve sensitive database contents
- An attacker could infer information through blind database queries
- Database records may be exposed beyond intended authorization boundaries
- Application and user data could be altered if the database account permits write operations
- Database availability may be affected by resource-intensive queries
- An attacker may retrieve sensitive database contents
- An attacker could infer information through blind database queries
- Database records may be exposed beyond intended authorization boundaries
- Application and user data could be altered if the database account permits write operations
- Database availability may be affected by resource-intensive queries
General mitigation guidance
Mitigation generally focuses on removing SQL interpretation from request-controlled values.
Common defensive patterns include:
- Use parameterized queries or framework APIs that bind values rather than concatenate SQL fragments
- Avoid passing untrusted input to raw query-builder methods such as
last() - Apply strict allowlist validation for numeric identifiers and pagination values
- Enforce authentication and authorization for resource lookup operations where appropriate
- Run the application with a database account limited to required privileges
- Return minimal query results and avoid exposing unnecessary database errors
Mitigation generally focuses on removing SQL interpretation from request-controlled values.
Common defensive patterns include:
- Use parameterized queries or framework APIs that bind values rather than concatenate SQL fragments
- Avoid passing untrusted input to raw query-builder methods such as
last() - Apply strict allowlist validation for numeric identifiers and pagination values
- Enforce authentication and authorization for resource lookup operations where appropriate
- Run the application with a database account limited to required privileges
- Return minimal query results and avoid exposing unnecessary database errors
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis rules for string concatenation in SQL and raw query-builder APIs
- Code review checks for request parameters passed to
last(), raw SQL, or dynamically assembled clauses - Dynamic testing of numeric and pagination parameters using safe SQL injection test cases
- Web application firewall or API gateway policies monitoring anomalous query-parameter patterns
- Database audit logging for unexpected unions, conditional probes, or abnormal query activity
Automated code review and software composition analysis tools may help identify unsafe query construction patterns.
Organizations can identify similar issues through:
- Static analysis rules for string concatenation in SQL and raw query-builder APIs
- Code review checks for request parameters passed to
last(), raw SQL, or dynamically assembled clauses - Dynamic testing of numeric and pagination parameters using safe SQL injection test cases
- Web application firewall or API gateway policies monitoring anomalous query-parameter patterns
- Database audit logging for unexpected unions, conditional probes, or abnormal query activity
Automated code review and software composition analysis tools may help identify unsafe query construction patterns.
