iceCMS Access Control Vulnerability in Square Comment API

An access control vulnerability has been identified in iceCMS version 2.2.0, specifically within the Square Comment API endpoint 'DelectSquareById'. This vulnerability allows unauthenticated attackers to access sensitive information by exploiting improper access controls, particularly in the content management features of the admin interface.

Impact

Exploitation of this vulnerability could lead to unauthorized access and deletion of user data.

Reproduction

To reproduce this vulnerability, send a GET request to the '/api/squareComment/DelectSquareById' endpoint, including the ID of the comment to be accessed. The request can be made without an authorization token, which will bypass authentication and allow access to sensitive information.