CVE-2023-52064 is a critical severity (9.8 CVSS) SQL injection in Wuzhicms v4.1.0, reached through the keywords parameter of the admin copyfrom.php page. The upstream issue is still open and we found no fixed release, so restrict the admin area and review the code.
What's affected
The NVD record lists Wuzhicms 4.1.0. The upstream GitHub issue number 208, opened on December 25, 2023, describes the same version. When we fetched it, the issue was open with no maintainer comments, no linked fix and no assigned labels.
That means we cannot name a fixed version. Check the project's repository for later commits or releases before assuming you are covered.
How to check if you're exposed
Find out whether you run Wuzhicms at all. Look for the application directory on your web hosts and check the version string in its admin footer or release files. A dependency inventory helps if the CMS was installed by an agency or a former employee. The free in-browser dependency scan can help with packaged dependencies, but a standalone CMS install usually has to be found by looking at your hosting inventory.
Then check whether the admin path is reachable from the internet. If it is, put it behind a VPN, an IP allow list or HTTP authentication.
What to do now
- Locate every Wuzhicms 4.1.0 install, including forgotten staging sites.
- Restrict the admin directory by network, so only trusted addresses can reach it.
- Review the copyfrom listing code and use parameterized queries in place of string built SQL.
- Place a web application firewall rule in front of the admin area as a stopgap, not a fix.
- Watch the upstream issue for a maintainer response, and consider moving off the product if it stays unmaintained.
Why it matters
The record maps this to CWE-89, SQL injection. The reporter says the keywords input is placed into a LIKE clause without strict filtering, so input can change the structure of the query rather than being treated as data.
The NVD vector shows no privileges required, which is why the score is 9.8, although the vulnerable file sits in the admin area, so in practice network placement of that area matters a great deal. A database read through this kind of flaw can expose accounts and content. The KEV flag is false and we found no claim of exploitation in the wild.
For a wider view, the free in-browser dependency scan and the Gold directory help you see which packaged components in your own code carry known CVEs, and reachability analysis helps you decide which ones matter first.
Quick check
What is the correct code level fix for SQL injection?
Use parameterized queries or prepared statements so input is always bound as data, and never concatenate user input into SQL.
Sources
Last reviewed: 19 October 2026.
