CVE-2025-13786
📋 TL;DR
This CVE describes a remote code injection vulnerability in taosir WTCMS that allows attackers to execute arbitrary code by manipulating the 'content' parameter in the fetch function. The vulnerability affects all versions up to commit 01a5f68a3dfc2fdddb44eed967bb2d4f60487665, and since the vendor uses a rolling release model with no version details, all installations should be considered vulnerable until proven otherwise.
💻 Affected Systems
- taosir WTCMS
📦 What is this software?
Wtcms by Wtcms Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal data, install malware, or pivot to other systems.
Likely Case
Remote code execution leading to website defacement, data theft, or deployment of web shells for persistent access.
If Mitigated
Limited impact with proper input validation, WAF rules, and network segmentation preventing successful exploitation.
🎯 Exploit Status
Proof-of-concept is publicly available on GitHub, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - vendor did not respond to disclosure
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative CMS or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation and sanitization for the 'content' parameter in the fetch function
Modify /index.php to add input filtering: $content = filter_var($_POST['content'], FILTER_SANITIZE_STRING);
WAF Rule Implementation
allDeploy web application firewall rules to block suspicious parameter manipulation
Add WAF rule: SecRule ARGS:content "@rx [;|&`$()]" "id:1001,phase:2,deny,status:403,msg:'Possible code injection attempt'" (ModSecurity example)
🧯 If You Can't Patch
- Isolate the WTCMS instance behind a reverse proxy with strict input validation
- Implement network segmentation to limit the blast radius if compromised
🔍 How to Verify
Check if Vulnerable:
Check if your WTCMS installation includes the vulnerable commit by examining the codebase or checking for the specific fetch function in /index.phpCheck Version:
No standard version command - check git commit history or file timestampsVerify Fix Applied:
Test the application with the public PoC to ensure it no longer executes arbitrary code📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /index.php with manipulated 'content' parameter
- System command execution from web process
- Unexpected process spawns from web server
Network Indicators:
- HTTP requests containing shell metacharacters in parameters
- Outbound connections from web server to suspicious IPs
SIEM Query:
source="web_logs" AND uri="/index.php" AND (param="content" AND value MATCHES "[;|&`$()]" OR "exec" OR "system" OR "shell_exec")🔗 References
- https://github.com/TiKi-r/CVE-Report/blob/main/WtcmsRCE.md
- https://github.com/TiKi-r/CVE-Report/blob/main/WtcmsRCE.md#3-proof-of-concept-poc
- https://vuldb.com/?ctiid.333790
- https://vuldb.com/?id.333790
- https://vuldb.com/?submit.689523
- https://github.com/TiKi-r/CVE-Report/blob/main/WtcmsRCE.md
- https://github.com/TiKi-r/CVE-Report/blob/main/WtcmsRCE.md#3-proof-of-concept-poc
