External risk intelligence

iCMS bakupdata SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-39806

iCMS is a Content Management System typically deployed as a public-facing web application. Since the vulnerability exists within the application's core functionality, it is commonly accessible via the internet as part of the standard web server deployment.

SQL Injection

Idreamsoft Icms

7.0.16

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the iCMS content management system that could allow unauthorized access and manipulation of data. This issue is particularly concerning due to its potential for remote exploitation without requiring any user interaction or prior access privileges.

Flaw lets outsiders insert malicious database commands.
Matters for data protection and system integrity.
Confirm if our iCMS systems are affected.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the `bakupdata` function, which lacks proper input sanitization. This could allow them to inject malicious SQL commands, potentially leading to unauthorized data access or modification.

No special access needed.
Triggered by vulnerable function input.
Risk of full data compromise.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in the bakupdata function of iCMS could allow an attacker to execute arbitrary SQL commands. This could impact the integrity and availability of the system, and potentially expose sensitive data.

System data integrity and availability.
Remote unauthenticated SQL command execution.
Unauthorized data access or system disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in iCMS affects public-facing web applications. Identifying all iCMS instances, determining their business criticality and internet reachability, and assigning ownership to the responsible team are the immediate priorities. Once assessed, a risk-based remediation plan can be developed.

Application or platform owners should own the issue.
Verify internet exposure and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is iCMS?

iCMS is a content management system developed by idreamsoft designed to help users manage, organize, and publish digital content on websites. It acts as the underlying software platform that handles database interactions to serve web pages, store user information, and maintain site functionality.

What does SQL injection mean for CVE-2023-39806?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain English, it means the software does not properly filter user input before using it to communicate with the database. Because the bakupdata function fails to sanitize requests, an attacker can input their own database commands, tricking the system into executing unauthorized operations.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specially crafted request directly to the bakupdata function within the iCMS software. It is important to note that the vulnerability is specific to this function; interacting with other parts of the application or performing standard, non-malicious actions will not trigger the bug.

Why is this CVE concerning for my web servers?

According to Halo Surface Signal, iCMS is typically deployed as a public-facing web application, making it highly likely that the affected component is accessible via the internet. Because the vulnerability allows for unauthenticated access, any server running the affected version of iCMS that can be reached by the public web is at risk.

Do I need to take action if I use iCMS?

Yes. Your first step should be to identify all running instances of iCMS to determine if you are using version 7.0.16. Once you have located these instances, evaluate their business criticality and internet reachability. Assign ownership to the appropriate technical team so they can prioritize a risk-based remediation plan to secure your data.

References

gist.github.com/ChubbyZ/27fa6f43699c9964ddfa701614fc4d5e

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.