CVE-2023-39805

CriticalCVSS 9.8

Published: 10/08/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

39th percentile - higher than 39% of all known CVEs

Summary

A SQL injection vulnerability was discovered in iCMS version 7.0.16 via the 'where' parameter in admincp.php. An attacker can exploit this flaw to execute unauthorized database queries.

Risk Assessment

The risk involves potential theft, modification, or deletion of database data, leading to compromised confidentiality and integrity of information, as well as possible application takeover.

Recommendation

It is recommended to immediately upgrade iCMS to the latest available version that fixes this vulnerability. If an upgrade is not possible, apply temporary mitigations such as input validation and sanitization for the 'where' parameter.

Original NVD description (English source)

iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.