CVE-2025-13782: Wtcms_project Wtcms SQLi Vulnerability

CVE-2025-13782 Overview

A SQL injection vulnerability has been identified in taosir WTCMS, an open-source content management system. The vulnerability exists in the delete function within the SlideController.class.php file, where improper handling of the ids parameter allows attackers to inject malicious SQL statements. This flaw enables remote exploitation without authentication, potentially compromising database integrity and exposing sensitive information.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to read, modify, or delete database contents, potentially leading to full database compromise and unauthorized access to sensitive data.

Affected Products

• WTCMS up to commit 01a5f68a3dfc2fdddb44eed967bb2d4f60487665
• wtcms_project wtcms (all rolling release versions)
• WTCMS installations using the affected SlideController component

Discovery Timeline

• 2025-11-30 - CVE-2025-13782 published to NVD
• 2025-12-11 - Last updated in NVD database

Technical Details for CVE-2025-13782

Vulnerability Analysis

This SQL injection vulnerability affects the administrative slide management functionality in WTCMS. The vulnerability exists in the delete function located in application/Admin/Controller/SlideController.class.php. When processing deletion requests, the application fails to properly sanitize user-supplied input in the ids parameter before incorporating it into SQL queries.

The vulnerability is classified under CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Because WTCMS follows a rolling release model, traditional version-based patch tracking is not available, making it critical for administrators to ensure they are running the latest code from the repository.

The vendor was contacted early about this disclosure but did not respond, leaving users without official guidance on remediation.

Root Cause

The root cause of this vulnerability is insufficient input validation and the absence of parameterized queries or prepared statements in the delete function of SlideController.class.php. The ids parameter is directly concatenated into SQL queries without proper sanitization, escaping, or type validation. This allows an attacker to break out of the intended query context and inject arbitrary SQL commands.

Attack Vector

The attack can be executed remotely over the network. An attacker sends a crafted HTTP request to the slide deletion endpoint with a malicious payload in the ids parameter. Since no user interaction is required and the attack complexity is low, exploitation is straightforward for anyone with network access to the WTCMS administrative interface.

The vulnerability allows attackers to:

• Extract sensitive data from the database through UNION-based or blind SQL injection techniques
• Modify or delete database records
• Potentially escalate privileges if database credentials have elevated permissions
• In some configurations, execute operating system commands through database features like xp_cmdshell (SQL Server) or LOAD_FILE/INTO OUTFILE (MySQL)

For technical details and proof-of-concept information, refer to the Yuque Security Document and the VulDB entry #333786.

Detection Methods for CVE-2025-13782

Indicators of Compromise

• Unusual SQL error messages appearing in web application logs or error pages
• Unexpected database queries containing SQL keywords like UNION, SELECT, DROP, or -- in the ids parameter
• Abnormal traffic patterns to the /Admin/Slide/delete endpoint or similar slide management URLs
• Database audit logs showing queries that deviate from expected patterns

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in request parameters
• Monitor HTTP request logs for suspicious characters in the ids parameter such as single quotes, semicolons, and SQL keywords
• Enable database query logging and alert on anomalous query structures
• Deploy intrusion detection systems (IDS) with signatures for common SQL injection attack patterns

Monitoring Recommendations

• Enable comprehensive logging for all administrative endpoints in WTCMS
• Configure real-time alerts for repeated failed or malformed requests to the SlideController
• Implement database activity monitoring to detect unauthorized data access or modifications
• Review access logs regularly for requests from unexpected IP addresses targeting admin functions

How to Mitigate CVE-2025-13782

Immediate Actions Required

• Restrict network access to the WTCMS administrative interface using firewall rules or IP whitelisting
• Implement a Web Application Firewall (WAF) with SQL injection protection rules
• Review and audit database user permissions to follow the principle of least privilege
• Consider taking the application offline if it contains sensitive data and cannot be adequately protected

Patch Information

As WTCMS follows a rolling release model, there are no traditional versioned patches. Users should pull the latest code from the official repository and verify that the vulnerability has been addressed. However, since the vendor did not respond to disclosure attempts, it is unclear if an official fix has been released. Check the VulDB submission #688837 for updates on remediation status.

Workarounds

• Implement input validation at the application level by modifying SlideController.class.php to use parameterized queries or prepared statements
• Add server-side validation to ensure the ids parameter contains only numeric values
• Deploy a reverse proxy with mod_security or similar WAF capabilities to filter malicious requests
• Disable or restrict access to the slide management functionality until a proper fix is confirmed

# Example: Restrict access to admin panel using .htaccess (Apache)
<Directory "/path/to/wtcms/application/Admin">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Directory>