iCMS vulnerabilities

A SQL injection vulnerability was discovered in iCMS v7.0.16 within the bakupdata function. Attackers can exploit this flaw to execute unauthorized database queries.

A SQL injection vulnerability was discovered in iCMS version 7.0.16 via the 'where' parameter in admincp.php. An attacker can exploit this flaw to execute unauthorized database queries.

A vulnerability was detected in iCMS up to version 8.0.0. The Save function in the file app/config/ConfigAdmincp.php of the POST Parameter Handler component allows code injection via manipulation of the config argument. The attack can be launched remotely, and the exploit is now public.