CVE-2023-33356

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via union-based or blind techniques.

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.

An issue was discovered in IceCMS version 2.0.1, allowing attackers to escalate privileges and gain sensitive information via the UserID parameter in api/User/ChangeUser.

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using union-based or blind techniques.

In IceCMS version 3.4.7 and earlier, an incorrect access control vulnerability exists in the loginAdmin method within UserController.java. Attackers can authenticate by entering arbitrary values as the username and password.

IceCMS v1.0.0 has insecure permissions, leading to unauthorized access to the API and disclosure of sensitive information.