Impact
The Backend Filter widget (Backend\Widgets\Filter) is vulnerable to SQL injection through the numberrange scope type when the scope is configured with a conditions key. An authenticated backend user with access to a list view containing a vulnerable filter scope can inject arbitrary SQL via the filter's AJAX handler, potentially gaining read access to the full database contents.
To exploit this, an attacker must have a valid backend account with access to a list view where a third-party plugin has registered a numberrange filter scope using the conditions configuration key. No built-in Winter CMS backend views use this scope type and configuration combination, so a vanilla installation without plugins is not exploitable.
Patches
This issue has been fixed in Winter CMS v1.2.13.
Workarounds
If users cannot upgrade, they may apply commit wintercms/winter@50713de to your Winter CMS
installation manually to resolve this issue.
References
M9nx Reporter
turgutAgha Reporter
Impact
The Backend Filter widget (
Backend\Widgets\Filter) is vulnerable to SQL injection through thenumberrangescope type when the scope is configured with aconditionskey. An authenticated backend user with access to a list view containing a vulnerable filter scope can inject arbitrary SQL via the filter's AJAX handler, potentially gaining read access to the full database contents.To exploit this, an attacker must have a valid backend account with access to a list view where a third-party plugin has registered a
numberrangefilter scope using theconditionsconfiguration key. No built-in Winter CMS backend views use this scope type and configuration combination, so a vanilla installation without plugins is not exploitable.Patches
This issue has been fixed in Winter CMS v1.2.13.
Workarounds
If users cannot upgrade, they may apply commit wintercms/winter@50713de to your Winter CMS
installation manually to resolve this issue.
References