IceCMS versions up to 4.1.5 allow unauthenticated SQL injection by supplying a malicious 'num' path parameter to the '/WebResource/findresourcebynum' endpoint. The vulnerability results from concatenating unvalidated user input into the LIMIT clause via QueryWrapper.last(), enabling attackers to inject UNION‑based or blind SQL statements. The affected code can therefore expose database contents, compromising confidentiality and potentially allowing data exfiltration or manipulation without requiring any authentication.

Thecosy IceCMS, versions 4.1.5 and earlier, are affected. No specific subversion list is supplied, but all releases of IceCMS through 4.1.5 contain the flaw.

The CVSS score of 8.7 indicates a high severity, and while the EPSS score is not available, the lack of a KEV listing suggests limited public exploitation data. The attack vector is remote web access; an attacker can trigger the injection by sending a crafted HTTP request to the vulnerable endpoint, making this vulnerability exploitable over the network without local privileges. Given the remote nature and lack of authentication requirement, the risk to exposed deployments is significant.