An issue was discovered in taocms 3.0.2. This is a SQL blind injection that can obtain database data through the Comment Update field.