CVE-2025-13782: Critical SQL Injection Vulnerability Threatens WTCMS Users

Overview

CVE-2025-13782 describes a high-severity SQL injection vulnerability affecting WTCMS (version up to commit 01a5f68a3dfc2fdddb44eed967bb2d4f60487665). This vulnerability resides within the SlideController component, specifically in the delete function of the application/Admin/Controller/SlideController.class.php file. A malicious actor can exploit this flaw by manipulating the ids argument to execute arbitrary SQL queries, potentially compromising the entire database.

Technical Details

The vulnerability stems from insufficient sanitization of the ids parameter passed to the delete function in the SlideController. This lack of input validation allows an attacker to inject malicious SQL code into the query, leading to unauthorized data access, modification, or deletion. The attack can be performed remotely without authentication, amplifying the risk. The specific vulnerable code is located in application/Admin/Controller/SlideController.class.php.

CVSS Analysis

The CVSS score for CVE-2025-13782 is 7.3, classifying it as a HIGH severity vulnerability. This score reflects the following characteristics:

• Attack Vector: Network (AV:N) – Exploitation can occur remotely.
• Attack Complexity: Low (AC:L) – The vulnerability is relatively easy to exploit.
• Privileges Required: None (PR:N) – No authentication is required.
• User Interaction: None (UI:N) – No user interaction is required.
• Scope: Changed (S:C) – An exploitation can affect components beyond the vulnerability’s scope.
• Confidentiality Impact: High (C:H) – Sensitive information can be accessed.
• Integrity Impact: High (I:H) – Data can be modified or deleted.
• Availability Impact: High (A:H) – The application may become unavailable.

Possible Impact

Successful exploitation of CVE-2025-13782 can have severe consequences, including:

• Data Breach: Sensitive data stored in the WTCMS database can be accessed and exfiltrated by attackers.
• Data Manipulation: Attackers can modify or delete critical data, leading to data corruption or loss.
• System Compromise: In some cases, successful SQL injection can lead to complete system compromise, allowing attackers to execute arbitrary code on the server.
• Denial of Service: Attackers can disrupt the availability of the WTCMS application, rendering it unusable for legitimate users.

Mitigation and Patch Steps

Unfortunately, the vendor (taosir) has not responded to vulnerability reports and does not provide specific version details due to a rolling release approach. Therefore, the following mitigation steps are recommended:

• Input Sanitization: Thoroughly sanitize all user-supplied input, especially the ids parameter in the delete function of the SlideController. Use parameterized queries or prepared statements to prevent SQL injection.
• Principle of Least Privilege: Ensure that the database user account used by WTCMS has only the necessary privileges. Avoid granting excessive permissions.
• Web Application Firewall (WAF): Implement a Web Application Firewall (WAF) to detect and block malicious SQL injection attempts. Configure the WAF with appropriate rules and signatures.
• Code Review: Conduct a thorough code review of the SlideController.class.php file, paying close attention to the delete function and any other areas that handle user input.
• Monitor and Alert: Implement robust monitoring and alerting mechanisms to detect suspicious activity and potential SQL injection attempts.
• Consider Alternative CMS: If the lack of vendor support and security updates is a major concern, consider migrating to a more actively maintained and secure CMS platform.

References

• VulDB: https://vuldb.com/?ctiid.333786
• VulDB: https://vuldb.com/?id.333786
• VulDB Submit: https://vuldb.com/?submit.688837
• Yuque (Proof of Concept): https://www.yuque.com/shangu-vvuup/ydpg69/amhlbdhkw0pgt44g?singleDoc