CVE-2023-39805
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A SQL injection vulnerability was discovered in iCMS version 7.0.16 via the 'where' parameter in admincp.php. An attacker can exploit this flaw to execute unauthorized database queries.
Risk Assessment
The risk involves potential theft, modification, or deletion of database data, leading to compromised confidentiality and integrity of information, as well as possible application takeover.
Recommendation
It is recommended to immediately upgrade iCMS to the latest available version that fixes this vulnerability. If an upgrade is not possible, apply temporary mitigations such as input validation and sanitization for the 'where' parameter.
Other vulnerabilities in iCMS
See all- CVE-2023-39806Critical
A SQL injection vulnerability was discovered in iCMS v7.0.16 within the bakupdata function. Attackers can exploit this flaw to execute unauthorized database queries.
- CVE-2025-15394Medium
A vulnerability was detected in iCMS up to version 8.0.0. The Save function in the file app/config/ConfigAdmincp.php of the POST Parameter Handler component allows code injection via manipulation of the config argument. The attack can be launched remotely, and the exploit is now public.
Original NVD description (English source)
iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS