CVE-2025-13783 is a medium severity SQL injection flaw (CVSS 6.3) in taosir WTCMS (builds up to commit 01a5f68a3dfc2fdddb44eed967bb2d4f60487665), affecting the check, uncheck and delete functions of CommentadminController in application/Comment/Controller/CommentadminController.class.php, through the ids argument. No version is listed because releases roll, so verify your code and restrict access.
What's affected
The affected component is the check, uncheck and delete functions of CommentadminController in application/Comment/Controller/CommentadminController.class.php, through the ids argument. The CVE record says an attacker can manipulate that argument to alter the SQL the application sends to its database, and that the attack can be launched remotely.
Affected version: builds up to commit 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. The record says the project uses rolling releases, so no version details are given for affected or updated builds, and that the vendor did not respond to the disclosure.
The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The attack vector is the network, and the vector lists low privileges required, so an attacker needs some kind of valid account first. The weakness classes are CWE-74, CWE-89.
The CVE record states that the exploit has been disclosed publicly. That is not the same as exploitation in the wild, which the record does not report, and the CISA Known Exploited Vulnerabilities flag is false. Still, public details lower the effort needed to attack an exposed instance.
How to check if you're exposed
Start by finding out whether you run this software at all. It is a standalone web application, not a library you pull from a package registry, so a dependency scan will not list it. Search your hosts and web roots for the product name and the vulnerable file.
find /var/www -type f -name "CommentadminController.class.php" 2>/dev/null
grep -rnE "(mysql_query|mysqli_query|->query)\(" /var/www/PATH_TO_APP | head
The second command is only a starting point. It shows where the code builds queries, so you can see whether request values are placed straight into query strings. Then look at your web server logs for the vulnerable path and read through unusual values in the ids parameter.
grep "CommentadminController.class.php" /var/log/nginx/access.log | grep -Ei "%27|union|sleep\(" | head
Adjust the log path for Apache or your own setup. A hit does not prove compromise, and a clean log does not prove safety, but it tells you where to look first.
What to do now
- Find every copy of taosir WTCMS in your estate, including test and demo servers that are easy to forget.
- Take the application off the public internet or put it behind a VPN or an IP allowlist until it is fixed.
- If you maintain the code, switch the affected query to a prepared statement with bound parameters and validate the ids value on the server side.
- Check that the database account the application uses has only the privileges it needs. It should not be able to read other schemas or write files.
- Review logs for the vulnerable path, and rotate any credentials stored in that database if you see signs of abuse.
- Watch the vendor or project page for a patched release, and apply it when one appears.
Why it matters
SQL injection happens when user input ends up inside a database query as part of the query text, so the database cannot tell data from instructions. The weakness is catalogued as CWE-74, CWE-89, and CWE-89 is one of the oldest and best understood classes in web security. The fix is also well understood: keep data and query text separate by using parameterised queries, and never build SQL by joining strings.
Small PHP applications of this type are often written as teaching or sample projects and then deployed for real use. They rarely receive security review and often have no maintainer who ships patches. That is why the practical advice leans on reducing exposure instead of waiting for a vendor release.
Quick check
Does exploiting this need a valid account?
The CVSS vector for this record decides that, and The attack vector is the network, and the vector lists low privileges required, so an attacker needs some kind of valid account first. Even where an account is required, treat any internet-facing instance as reachable by anyone who can register or guess a password.
Is there a patch for taosir WTCMS?
The record says the project uses rolling releases, so no version details are given for affected or updated builds, and that the vendor did not respond to the disclosure.
Sources
- Gold vulnerability page for CVE-2025-13783
- CVE record for CVE-2025-13783 as published by its CNA, with a published date of 2025-11-30
- Free in-browser dependency scan: gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
