External risk intelligence

iCMS SQL Injection Vulnerability in Admin Panel

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-39805

iCMS is a content management system. These platforms are commonly deployed as internet-facing web applications to serve public content, and the vulnerable component is an administrative control interface accessed via the web server, which is frequently exposed to the internet in standard deployments.

SQL Injection

Idreamsoft Icms

7.0.16

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in iCMS, a content management system. This SQL injection flaw, present in the administrative interface, could allow unauthorized access and manipulation of data if exploited. The main concern is confirming if our organization utilizes this specific software and is therefore exposed.

Allows unauthorized data access and control.
Content management systems are often internet-facing.
Confirm iCMS use and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the vulnerable `admincp.php` script. If the `where` parameter is not properly sanitized, the attacker could inject malicious SQL commands, potentially leading to unauthorized access and modification of data.

Unauthenticated network access required.
SQL injection in `admincp.php`'s `where` parameter.
Potential for data compromise and system control.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in the `where` parameter of `admincp.php` could allow an unauthenticated attacker to execute arbitrary SQL commands on the underlying database. This could impact the integrity and availability of the content management system's data.

System data.
Network access to the parameter.
Database corruption or unauthorized data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that iCMS is a web-based content management system, the platform or infrastructure teams responsible for its deployment are likely accountable for addressing this SQL injection vulnerability. The first practical step involves identifying all instances of iCMS, determining their exposure (especially to the internet), confirming business criticality, and locating the designated owner for each instance before planning remediation.

Platform/Infrastructure teams own the issue.
Verify iCMS deployment and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is iCMS?

iCMS is a content management system developed by idreamsoft. Organizations use this software to build, manage, and publish digital content on websites. It provides an administrative interface, known as admincp.php, which allows administrators to control site settings and database interactions.

What does SQL injection mean for CVE-2023-39805?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In simple terms, the software fails to properly check inputs. An attacker can input malicious database commands into the 'where' parameter, tricking the system into running unauthorized queries that reveal or modify sensitive data.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted request to the admincp.php file on an affected server. The flaw relies on the 'where' parameter failing to sanitize input. It is important to note that the vulnerability does not require a user to be logged in to the administrative panel to initiate the attack; it can be attempted by an unauthenticated party.

Do I need to worry about this if my server is internal?

Halo Surface Signal indicates that iCMS is typically deployed as an internet-facing application. Because the administrative interface is often exposed to the public web, this vulnerability poses a higher risk. If your instance is truly isolated from the internet, the immediate risk is lower, but you should still assess whether any internal users or compromised network segments could reach the administrative interface.

What are the first steps to take?

Begin by auditing your infrastructure to locate every instance of iCMS running in your environment. Once identified, verify if you are using version 7.0.16. Work with your platform or infrastructure teams to determine which instances are accessible via the internet and document the business owners for each system so you can prepare for necessary security updates or configuration changes.

References

gist.github.com/ChubbyZ/3ad434bd5fc2ab1242dd32500384cfb5

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.