CVE-2023-39806
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A SQL injection vulnerability was discovered in iCMS v7.0.16 within the bakupdata function. Attackers can exploit this flaw to execute unauthorized database queries.
Risk Assessment
The risk involves potential theft, modification, or deletion of database data, compromising the confidentiality and integrity of organizational information.
Recommendation
Immediately update iCMS to the latest available version that includes a fix for this vulnerability. Additionally, implement web application firewalls and input validation.
Other vulnerabilities in iCMS
See all- CVE-2023-39805Critical
A SQL injection vulnerability was discovered in iCMS version 7.0.16 via the 'where' parameter in admincp.php. An attacker can exploit this flaw to execute unauthorized database queries.
- CVE-2025-15394Medium
A vulnerability was detected in iCMS up to version 8.0.0. The Save function in the file app/config/ConfigAdmincp.php of the POST Parameter Handler component allows code injection via manipulation of the config argument. The attack can be launched remotely, and the exploit is now public.
Original NVD description (English source)
iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS